Security Engineer

Endpoint: CrowdStrike Falcon (AV/EDR, device control, vulnerability scanning, cloud IOA/IOM, FIM), BeyondTrust EPM, Automox patching, Microsoft Intune and Jamf MDM (BitLocker/FileVault).

Cloud (AWS US West 2 / US East 2): AWS WAF, Shield, KMS, Macie, IAM Identity Center (SSO), and Transit Gateway.

Identity & Access: Okta (SSO, MFA, workforce and customer identity, access reviews) and LastPass.

Network & Edge: Zscaler (SASE, CASB, DLP, web filtering), Cloudflare (Page Shield), F5, Palo Alto firewalls, and Cisco Meraki (Wi-Fi, NAC).

Email: Mimecast (gateway, encryption, DLP) and Valimail (DKIM/DMARC).

Application Security: GitHub Advanced Security, Sonar, and tfsec (code and IaC review).

Security Operations: SecurityHQ 24x7 SOC, DataDog SIEM.

Responsibilities

Security Operations and Engineering (80%)

Ensure that Security technical platforms and Services are always available.

Ensure that appropriate maintenance, monitoring, automation, and response procedures are in place, to meet Security and availability objectives.

Triage and respond to security alerts escalated from the SOC/SIEM, in a manner appropriate for level of severity (this could require responding outside normal business hours).

Support Security investigations as appropriate.

Provide subject matter expertise and technical stewardship across a broad range of technical platforms and service offerings.

Conduct operations with excellence, in a quality manner, in accordance with our change control and other documented processes.

Gather, analyze, and report on Service KPIs.

Own control evidence for assigned platforms in support of PCI DSS 4.0.1 and SOC 2 Type II audits.

Partner with IT stakeholders to engineer, implement, and enhance technical platforms and related Service Offerings on an ongoing basis.

Develop engineering patterns that facilitate the re-use of Services in a safe, efficient, and compliant manner.

Create/maintain diagrams of Security platforms and integrations.

Use automation and AI-assisted tooling to improve detection, response, and operational efficiency.

Serve as a technical resource on various initiatives.

Advocate for new/enhanced Security Services on behalf of all stakeholders.

Hold technical debt to minimum possible.

Contribute requirements to technology selection process.

Develop/maintain Security-related governance (standards and procedures) in alignment with overall Security objectives, governance, risk, and compliance/GRC.

Participate in testing and QA processes as required, to ensure that Service Offerings perform as expected.

Partner with business and technical consumers of Security Service Offerings, to ensure that requirements are being met, future needs understood, and supporting roadmaps are developed to anticipate those needs.

Learn and attend training related to monitoring, ongoing support, routine engineering, and operation of new and existing Security platforms and services.

Leadership (20%)

Own and drive the best-possible outcomes for your space.

Maintain awareness and commitment to company goals/targets.

Serve as situational team lead, for any incident response, return-to-service, or other troubleshooting events, driving issues to resolution and communicating timely status.

Establish and maintain good working relationships with all Security Ops & Engineering customers and other Security, CISO, IT, 3rd-party, client, and business stakeholders.

Drive enterprise adoption and re-use of Security Services and engineering patterns.

Provide expert advice, coaching, and counseling within discipline/functional area.

Mentor Security peers and others, including training on new administrative functions, sharing best practices, and cultivating ideas and subsequent business cases