Cybersecurity Engineer

Allegacy Federal Credit Union•Winston-Salem, NC

19d

About The Position

At Allegacy, every role supports the organization’s commitment to its members and communities and helps nurture relationships that promote members’ financial wellbeing. The Cybersecurity Engineer supports the Credit Union’s cybersecurity operations, with a primary focus on incident response. The role monitors for threats, triages alerts, investigates suspicious activity, coordinates containment and remediation, and works with internal teams and the managed detection and response (MDR) provider to reduce risk and improve resilience. The position also supports vulnerability response, incident documentation and evidence preservation, detection tuning, playbook development, tabletop exercises, post-incident reviews, and security improvements. It coordinates with internal teams and external partners during investigations, provides stakeholder updates, and participates in an incident response on-call rotation as required. The engineer uses frameworks such as MITRE ATT&CK and conducts light, hypothesis-driven threat hunting to identify malicious activity and assess control effectiveness.

Requirements

Bachelor’s degree in Information Systems, Information Technology, Management Information Systems, Computer Science, Computer Engineering, or a related field.
3–5 years of experience in information security, SOC operations, or incident response, including hands-on investigation and response to security events.
Strong problem-solving and analytical skills, with the ability to make timely decisions and use good judgment during incident response.
Strong verbal and written communication skills, including the ability to communicate information security concepts clearly to all areas of the business.
Ability to adapt to a changing business and technology environment.
Familiarity with financial services and credit union regulatory and legal security standards and requirements, such as GLBA, NCUA, FFIEC guidance, PCI DSS, and Sarbanes-Oxley as applicable.
Hands-on knowledge of incident response practices, including triage, investigation, containment and eradication, and recovery; ability to follow and improve playbooks and procedures.
Ability to analyze security telemetry, including Windows and Linux logs, firewall and VPN logs, DNS, proxy, and authentication logs, to identify indicators of compromise and suspicious behavior.
Experience with security monitoring and detection tools, such as SIEM queries and dashboards and EDR, and familiarity with alert tuning and correlation concepts.
Knowledge of Identity and Access Management concepts, including MFA and privileged access management, and common investigation points for authentication-related incidents.
Familiarity with data protection controls such as DLP and investigation and response to potential data exposure events.
Knowledge of risk management processes, including methods for assessing and mitigating risk, and how incidents affect business risk.
Knowledge of national and international cybersecurity laws, regulations, policies, and ethics.
Knowledge of cyber threats and vulnerabilities and the operational impacts of cybersecurity lapses.
Knowledge of cybersecurity principles and organizational requirements related to confidentiality, integrity, availability, authentication, and non-repudiation.
Knowledge of network traffic analysis concepts, tools, methodologies, and processes, including basic packet capture and analysis and web filtering technologies.
Knowledge of network attacks and their relationship to threats and vulnerabilities.
Working knowledge of networking fundamentals used in investigations, including TCP/IP, DNS, HTTP/S, routing, and VPN concepts, and common attacker techniques in enterprise environments.

Nice To Haves

Professional certifications preferred: Security+, CySA+, GCIH/GCIA or similar; CISSP/CCSP is a plus.

Responsibilities

Monitor security tooling, including SIEM, EDR, email and web security, and firewall and VPN logs; triage alerts and determine scope, severity, and response actions.
Investigate suspicious activity by analyzing logs and telemetry, correlating events across systems, and documenting findings in tickets and incident records.
Coordinate incident containment, eradication, and recovery with IT and application teams, including host isolation, indicator blocking, and remediation support.
Collect and preserve incident evidence, including logs, timelines, and indicators, and support forensic activities while maintaining chain-of-custody expectations.
Develop, maintain, and improve incident response playbooks and procedures; participate in tabletop exercises and post-incident reviews and drive corrective actions.
Tune detections and reduce false positives with tool owners; recommend improvements to alert logic, correlation rules, and response automation.
Support vulnerability response by validating exposure, tracking remediation, and coordinating patching or mitigating controls for critical findings.
Coordinate investigations and response activities with internal teams and external partners, including the MDR provider, technology vendors, and law enforcement as directed.
Implement and validate security changes that support incident response outcomes, such as blocks, access adjustments, and segmentation changes; follow through on hardening items identified during investigations.
Participate in an incident response on-call rotation as required, escalate promptly, provide stakeholder status updates, and support incident communications based on severity and business impact.
Use frameworks such as MITRE ATT&CK and conduct light, hypothesis-driven threat hunting to identify malicious activity and validate control effectiveness.
Stay current on threats, attacker techniques, and incident response practices; recommend process and control improvements based on lessons learned.