Information Security Engineer III

ICW Group•San Diego, CA

3d•$121,625 - $217,711•Hybrid

About The Position

The purpose of the Information Security Engineer III is to design secure architectures and develop cybersecurity approaches and techniques to protect ICW Group’s cloud, data, and/or AI-driven environments. This position will assist with strategic initiatives for short and long-term plans to identify and reduce the attack surface across applications and systems. This role partners closely with application, cloud, data, and analytics teams to ensure security is embedded into systems from design through production. This role supports ICW’s modern data initiatives by reducing risk, strengthening security controls, and enabling secure adoption of new technologies in a highly regulated insurance environment. The engineer contributes across vulnerability management, threat detection, and incident response while providing practical security guidance that balances risk, compliance, and business needs.

Requirements

Bachelor's Degree required in Engineering, Cybersecurity, Networking, or Computer Science related discipline.
Minimum 8 years of experience working in a security engineering related role designing secure networks, systems and application architectures or equivalent combination of education and experience required.
Minimum 3-5 years of experience in AWS Cloud Security services preferred.
Direct experience using advanced technologies such as Intrusion Detection & Prevention Systems (IDS/IPS), Firewalls, SIEM, Antivirus software, Network Packet Analyzers, content filtering, Malware analysis and forensics tools to detect intrusions.
Experience in cyber security role requiring knowledge of data analysis, risk assessment, risk mitigation, investigation methods, incident management concepts and practices, and policy and procedure development.
Experience with AWS Services such as AWS Identity & Access Management, AWS Organizations, AWS Security HuB, Guard Duty, CloudTrail, AWS CloudTrail.
Knowledge of risk assessment tools, technologies, and methodologies.
Knowledge of disaster recovery, computer forensic tools, technologies, and methods.
Knowledge of enterprise security platforms.
Ability to communicate network security issues to peers and management.
Ability to read and use the results of mobile code, malicious code, and anti-virus software.
Strong understanding of endpoint security solutions to include File Integrity Monitoring and Data Loss Prevention.
Demonstrated experience as a lead engineer in the design, implementation and support in an enterprise IT environment.
Ability to combine disparate skills and thinking to craft solutions and solve complex operational problems.
Ability to hypothesize on root cause of inefficiencies and then test out probable solutions against those hypotheses.
Must be able to read, write and speak English effectively.
Ability to effectively communicate/present technical information to a non-technical audience.
Ability to cross train and share information with team members.

Nice To Haves

Certification in GSEC, CISSP, and/or Security+ preferred.
AWS Certified Security – Specialty, preferred.

Responsibilities

Monitors cloud, on-prem, and SaaS environments for security threats using SIEM, EDR, cloud-native logging, and network telemetry.
Assists with security incident response activities, including investigation, containment, remediation, and post-incident analysis.
Researches and implements methods to remediate network and application security vulnerabilities.
Leads and participates in security architecture controls reporting, compliance audits, monthly and ad-hoc statistics and trends, and risk-focused reports including internal and 3rd party Risk Assessments.
Produce risk-focused security findings and communicate clearly with technical and non-technical stakeholders.
Conducts threat hunting and root-cause analysis to identify anomalous behavior, exploitation attempts, and indicators of compromise.
Investigates potential data misuse, data exfiltration, and anomalous access patterns using logs, DLP, and monitoring tools.
Prepares and analyses system security reports by collecting, analyzing, and summarizing data and trends and makes recommendations to improve security.
Serve as a senior technical contributor across cloud security, including IAM, logging, monitoring, detection, and secure deployment patterns.
Lead or contribute to vulnerability management across cloud infrastructure, applications, containers, and data platforms.
Participate in offensive and defensive security activities, including threat modeling, red team exercises, blue team detection improvements, and threat hunting.
Support incident response investigations involving cloud misconfigurations, data exposure, and/or AI-related security events.
Perform security architecture reviews and provide guidance to engineering teams to reduce risk while enabling business objectives.
Implement and improve security controls that strengthen ICW’s overall security posture while supporting modern cloud and data initiatives.
Partners with Engineering, Infrastructure, Cloud, Data, and Operations teams to embed security into system design and delivery.
Lead security reviews for new data, analytics, and/or AI initiatives, including architecture reviews and risk assessments prior to production deployment.
Conduct threat modeling and security design reviews for systems involving data, analytics, AI, and/or cloud services.
Create and maintain technical security standards and guardrails related to data protection, cloud usage, and/or AI security.
Partner with internal teams to remediate security findings and track remediation activities through closure.
Provide security guidance that balances risk reduction with delivery speed and business priorities.
Executes technical and process changes required to adopt, maintain, and adjust InfoSec controls as required to manage the company's risks and align with industry best practices.
Partner with Engineering, Cloud, Data, Infrastructure, and Operations teams to embed security into system design and delivery.
Act as a trusted security advisor to project teams, helping them understand risk, controls, and secure design patterns.
Coach and mentor engineers on secure development, data handling, and cloud security best practices.
Work closely with project management and internal stakeholders to define and implement secure, scalable solutions.
Design and implement security controls to protect sensitive insurance data across AWS data platforms, analytics pipelines, and AI/ML workloads.
Provide security oversight for AI and LLM use cases, including model access controls, training data protection, inference security, data leakage prevention, and misuse/abuse risk.
Assess and mitigate risks related to AI systems, LLM usage, prompt injection, data poisoning, third-party data sources, and emerging AI threats.
Partner with Compliance and Governance teams to ensure data and AI controls align with NIST, NYDFS, PCI DSS, and California privacy regulations (CPRA/CCPA).
Contribute to the development of ICW’s AI security standards, guardrails, and internal guidance as AI adoption expands across the enterprise.
Support Third-Party Risk (TPR) evaluations for AI vendors, SaaS platforms, data providers, and analytics tools that process or access ICW data.
Evaluate and onboard security tools and vendors related to data protection, cloud security posture, AI governance, and detection.