Cybersecurity Engineer

Herff Jones•Indianapolis, IN

1d•Remote

About The Position

Herff Jones is seeking a Cybersecurity Engineer to join its Information Security team. The role owns the security tooling stack and detection engineering, ensuring platforms are operational and well-tuned and translating threat intelligence and incident lessons into detections. The engineer delivers security projects from the architecture roadmap and serves with the Cybersecurity Manager as a primary responder for major incidents. The position administers and improves enterprise security platforms, supports incident response and detection validation, and leads technical security roadmap initiatives. It also supports PCI DSS technical controls and provides evidence for independent assessment by the GRC Analyst. This is a remote role, primarily performed from a home office, with occasional travel to Herff Jones facilities. After-hours and weekend availability is required for Priority 1–2 incidents and scheduled maintenance windows.

Requirements

Hands-on production experience with enterprise XDR/EDR, identity and access management, and endpoint management platforms.
Experience with SIEM/XDR query languages such as KQL, SPL, or similar.
Scripting or automation skills in PowerShell or Python and comfort working with APIs.
Practical incident response experience and working knowledge of NIST SP 800-61 and MITRE ATT&CK.
Technical leadership and mentoring experience.
Bachelor’s degree in Computer Science, Information Security, Information Technology, or a related field, or equivalent work experience.
At least 5 years of experience in security engineering, security operations, or detection engineering.
Strong problem-solving and analytical mindset.
Ability to communicate complex technical and security concepts to non-technical stakeholders.
Composure and sound judgment under pressure during high-severity incidents.
Collaborative, proactive attitude focused on continuous improvement.
Strong organizational skills and attention to detail.
Must be available for after-hours and weekend response during Priority 1–2 security incidents and scheduled maintenance windows.

Nice To Haves

Industry security certifications such as CompTIA CySA+, GIAC GCIH or GCIA, AWS Certified Security – Specialty, Cisco CCNP Security, CrowdStrike CCFR, Microsoft SC-200/SC-500, Palo Alto Networks PCNSE, Splunk Certified Cybersecurity Defense Analyst, or equivalent.
Experience with data loss prevention (DLP), vulnerability management programs, or application security tooling.
Familiarity with PCI DSS technical requirements and OT or ICS environments.

Responsibilities

Administer, configure, and tune security platforms for endpoint and cloud protection, SIEM and MDR, vulnerability and attack surface management, application security, and email security.
Maintain security-tool health and coverage, including onboarding, agent and sensor deployment, maintenance, licensing use, integrations, and gap reporting against the asset inventory.
Assist with technical vendor relationships, including the MDR provider, and maintain current escalation paths and playbooks.
Automate repetitive work to reduce analyst toil and configuration drift.
Lead response during Priority 1–2 incidents.
Support security analysts and the MDR provider’s SOC with tickets during volume surges; tune alerts and develop response playbooks and automation for common alert types.
Measure detection quality using ATT&CK technique coverage, false-positive rate, and alert-to-incident ratio; run purple-team or atomic tests to validate detection rules.
Convert post-incident findings into new detections within the agreed time after an incident closes.
Serve as technical lead for roadmap initiatives involving data protection, identity and access hardening, network and IT/OT segmentation, cloud security posture, and controls for emerging technologies such as AI tools.
Write designs, build and test changes, hand off operational runbooks, and follow the Change Management Plan.
Support PCI DSS technical controls with evidence that the GRC Analyst can assess independently.
Perform other duties as assigned.