Cyber Security Engineer

ITT Inc. - English US•Remote, OH

1d•$99,900 - $149,100•Remote

About The Position

The Cybersecurity Engineer works in ITT’s Cybersecurity Operations Center (CSOC), with primary responsibility for deploying, configuring, and improving security tools, conducting threat hunting, and identifying advanced persistent threats. The role monitors security events, identifies vulnerabilities, assesses risks, and deploys controls to prevent unauthorized access, data breaches, and malicious activity. It partners with IT, infrastructure, and business teams to integrate security best practices into daily operations and meet regulatory, compliance, and organizational security requirements. The position supports incident response, threat detection, and continual improvement of the organization’s security posture. It manages security tools such as endpoint protection, email security, SASE/SSE, SIEM, and identity and access management systems; analyzes emerging threats; develops security standards and procedures; and supports security awareness initiatives. The role is remote, with an ideal candidate in the Eastern or Central U.S. time zones.

Requirements

Bachelor’s degree in computer science, information technology, cybersecurity, networking, or a related field.
At least 5 years of experience in cybersecurity or another discipline with transferable skills.
Familiarity with common and uncommon security tools and suites.
Familiarity with Google SecOps or equivalent SIEMs.
Experience with MDR and SIEM management.
Experience auditing Active Directory, Azure AD / Entra ID, and cloud environments.
Familiarity with CIS Benchmarks, configuration hardening standards, and security baselines.
Understanding of configuration-driven risk versus vulnerability-scan-only findings.
Ability to document complex technical findings in clear, defensible language.
Strong knowledge of the MITRE ATT&CK framework.
Strong investigation skills.
Ability to understand sources of risk, potential impacts, and likelihood, and advise on risk responses and mitigations.
Ability to identify insecure ports and protocols.
Strong knowledge of vulnerability management processes and the patch management lifecycle.
Analytical mindset and problem-solving skills to prioritize and manage risks effectively.
Collaborative approach and ability to build strong relationships across departments.
Demonstrated ability to write clear and concise technical documentation and policies.
Ability to multitask and change priorities on short notice.
High standard of professionalism and ethics.

Nice To Haves

Professional certifications such as C|EH, CISCP, or SANS certifications.
Experience with mergers and acquisitions technical due diligence.
Broad experience across IT operations, systems administration, cybersecurity, network administration, and/or directory services administration, including incident handling, risk identification and management, assessments, and IT function administration.

Responsibilities

Identify opportunities to improve existing security investments, add future investments, or address program gaps.
Maintain and deploy security controls and tool architecture.
Expand log sources and MDR integrations as needed.
Design and architect new solutions and services.
Increase automation and identify opportunities to augment existing tasks with AI.
Audit Active Directory and Azure AD configurations using tools such as Ping Castle and Azure AD / Entra Health Reports.
Identify identity configuration weaknesses involving authentication methods, privileged access, legacy protocols, and identity governance controls.
Support PAM and RBAC designs and discussions.
Conduct cloud configuration audits across Azure and other cloud platforms, including identity and access configurations, network security groups and routing, logging, monitoring, and security control enablement.
Audit Azure container and container platform configurations, focusing on role-based access controls, network exposure, secure defaults, and hardening requirements.
Develop and maintain security standard operating procedures, tool-specific guides, project plans, and business continuity plans.
Support continuous improvement of configuration policies and technical standards.
Conduct configuration and security posture reviews during mergers and acquisitions, including reviews of network and firewall configurations, identity platforms, cloud environments, vulnerabilities, and overall risk landscape.
Identify inherited configuration risks and provide actionable remediation guidance.
Produce clear, risk-focused audit findings and remediation recommendations for technical and non-technical stakeholders.
Collaborate with infrastructure, network, cloud, and identity teams to validate findings and drive corrective actions.
Support broader cybersecurity risk and governance initiatives as needed.
Monitor security events, identify vulnerabilities, conduct risk assessments, and deploy security controls.
Manage endpoint protection, email security, SASE/SSE, SIEM, and identity and access management tools.
Analyze emerging threats, support incident response and threat detection, develop security standards and procedures, and support security awareness initiatives.