Information Security Engineer

Farmers and Merchants Bank of Long Beach•Seal Beach, CA

1d•$113,880 - $193,960•Onsite

About The Position

The Information Security Engineer is a hands-on technical professional responsible for implementing, engineering, and continuously optimizing information security controls across the Bank's technology environment. Operating with a high degree of autonomy, this role focuses on designing, deploying, and operationalizing security solutions that protect the organization while supporting business objectives, regulatory requirements, and evolving threat landscapes. Working closely with the Chief Information Security Officer (CISO), Information Security Architect, and cross-functional IT stakeholders, the Information Security Engineer translates security requirements into effective technical controls and solutions. The position plays a key role in strengthening the Bank's security posture through risk assessments, security architecture enhancements, control validation, and continuous improvement initiatives. This role requires a strong balance of operational excellence and strategic thinking. The successful candidate will proactively identify security gaps, develop automation opportunities, enhance detection and response capabilities, and drive security maturity across the organization. Participation in after-hours support for critical security incidents and production issues may be required.

Requirements

Strong understanding of core information security domains, principles, controls, and industry best practices.
Demonstrated ability to assess security risks and implement effective technical security controls across enterprise environments.
Hands-on experience implementing, configuring, and managing: Firewalls and network security technologies, Web Application Firewalls (WAF), Intrusion Detection and Prevention Systems (IDS/IPS), Endpoint Detection and Response (EDR) and endpoint security platforms, Security Information and Event Management (SIEM) solutions such as Splunk, Sumo Logic, Microsoft Sentinel, or similar platforms, Vulnerability management and security scanning tools.
Experience with Windows and Linux server administration.
Experience with Enterprise network technologies, including: TCP/IP, DNS, DHCP, Network segmentation, Routing and switching fundamentals.
Microsoft Active Directory administration.
Identity and Access Management (IAM).
User provisioning, access reviews, and privileged access controls.
Working knowledge of Microsoft Azure security services and cloud security best practices.
Working knowledge of Microsoft 365 security controls and administration.
Working knowledge of Microsoft Intune.
Working knowledge of Conditional Access, identity protection, and endpoint management solutions.
Working knowledge of Cloud monitoring and security posture management concepts.
Experience with security logging, monitoring, alert triage, and detection engineering.
Ability to analyze security logs, event data, and network packet captures to identify malicious activity and attack patterns.
Understanding of common attack techniques including: SQL Injection, Cross-Site Scripting (XSS), Credential attacks, Malware activity, Lateral movement techniques, Privilege escalation attempts.
Familiarity with NIST Cybersecurity Framework (NIST CSF).
Familiarity with CIS Critical Security Controls.
Familiarity with Secure configuration standards and baseline management.
Familiarity with System hardening methodologies.
Familiarity with Security assessment and control validation practices.
Experience developing scripts and automation using Python, PowerShell, or similar technologies.
Ability to automate operational, monitoring, and security response processes to improve efficiency and reduce risk.
Understanding of Microsoft SQL Server security concepts, including: Authentication and authorization, Database access controls, Auditing and logging, Security configuration best practices, Vulnerability identification and remediation.
Strong analytical, troubleshooting, and problem-solving skills with the ability to assess complex technical issues and develop effective solutions.
Effective verbal and written communication skills, including the ability to clearly document technical findings, recommendations, and operational procedures.
Ability to explain technical concepts, security risks, and remediation strategies to both technical and non-technical stakeholders.
Demonstrated ability to manage multiple priorities, projects, and competing deadlines in a fast-paced environment.
Strong attention to detail and commitment to accuracy, consistency, and quality in all aspects of work.
Ability to work independently with minimal supervision while effectively collaborating across teams and organizational functions.
Strong interpersonal skills with the ability to build productive working relationships with technology teams, business partners, vendors, auditors, and leadership.
Proven ability to exercise sound judgment and make timely decisions during operational issues and security incidents.
Adaptability and resilience in responding to changing business needs, evolving threats, and emerging technologies.
Continuous learning mindset with a commitment to professional development and staying current on cybersecurity threats, trends, tools, and best practices.
Ability to maintain confidentiality and manage sensitive information with professionalism and discretion.
Customer service orientation with a focus on balancing security, operational effectiveness, and business objectives.
Operates standard electronic computers and customary office equipment required to perform essential job functions.
Use of equipment is required, with or without reasonable accommodation, in accordance with the Americans with Disabilities Act (ADA) and the California Fair Employment and Housing Act (FEHA).
Ability to perform repetitive movements associated with office and computer-based work.
Ability to sit and or stand for extended periods of time to perform essential job functions.
Ability to lift, carry, or move objects weighing up to 25 pounds, with or without reasonable accommodation.
Ability to use hands and fingers to manage, manipulate, or feel objects and operate standard office equipment.
Bachelor's degree in Computer Science, Information Security, Cybersecurity, Information Technology, or a related discipline; equivalent combination of education and relevant work experience may be considered.
Minimum of 7–9 years of progressive experience in information security, systems administration, infrastructure engineering, or a related technical field.
Demonstrated experience designing, implementing, and supporting enterprise security controls and technologies in complex environments.
Experience working within regulated industries, preferably financial services or banking environments.
Proven ability to independently manage security initiatives, operational responsibilities, and incident response activities.

Nice To Haves

CISSP (Certified Information Systems Security Professional)
SSCP (Systems Security Certified Practitioner)
CCSP (Certified Cloud Security Professional)
GCIH (GIAC Certified Incident Handler)
CEH (Certified Ethical Hacker)
Other relevant certifications from ISC², GIAC, CompTIA, Microsoft, or equivalent organizations
Microsoft Azure Security Engineer Associate (AZ-500) or equivalent cloud security certification.
Experience implementing, integrating, and administering enterprise security solutions across on-premises and cloud environments.
Experience with cloud security architecture, governance, and operational security practices.
Exposure to penetration testing, red team exercises, adversary simulation, or security assessment activities.
Familiarity with threat hunting methodologies and advanced detection engineering practices.
Experience supporting regulatory compliance initiatives, audits, and security assessments within a financial institution.
Knowledge of modern cybersecurity threats, attack techniques, and defensive strategies.

Responsibilities

Engineer, implement, and maintain information security controls across on-premises and cloud environments, including Microsoft Azure and Microsoft 365.
Translate security requirements, policies, and architectural designs into scalable, operationally effective security solutions.
Configure, manage, and optimize security technologies, including firewalls, web application firewalls (WAF), intrusion detection and prevention systems (IDS/IPS), endpoint protection platforms, and Security Information and Event Management (SIEM) solutions.
Monitor and respond to escalated security events and alerts; perform incident investigation, containment, remediation, and post-incident analysis.
Develop and maintain automation solutions using scripting and programming languages such as Python and PowerShell to improve detection, response, reporting, and operational efficiency.
Conduct vulnerability assessments, validate security control effectiveness, and support remediation efforts to reduce organizational risk.
Analyze system logs, security telemetry, and network traffic to identify malicious activity, attack patterns, and emerging threats.
Collaborate with Information Technology teams, vendors, and security leadership to implement, enhance, and maintain security capabilities.
Support security architecture initiatives by providing technical expertise and implementation guidance.
Assist with risk assessments and provide recommendations to strengthen the Bank’s overall security posture.
Provide technical guidance and mentorship to Information Security Analysts and contribute to the ongoing development of team capabilities.
Maintain accurate and complete documentation, including system configurations, operational procedures, incident records, and technical standards.
Adhere to established change management, operational, and security procedures.
Stay informed of emerging cybersecurity threats, vulnerabilities, technologies, and industry best practices.
Participate in an on-call rotation to support security incidents, critical alerts, and production issues.
Ensure timely response, investigation, escalation, and resolution in accordance with established service level expectations.
Provide after-hours support for critical security events, operational issues, and emergency situations.
Remain available to assist with high-priority incidents outside scheduled on-call periods when business need or risk severity warrants.
Comply with all applicable federal and state banking regulations, internal policies, and security standards.
Support compliance efforts related to: Bank Secrecy Act (BSA), Anti-Money Laundering (AML), Office of Foreign Assets Control (OFAC), Customer Identification Program (CIP), Financial Elder Abuse reporting requirements, Information security and data privacy regulations.
Support internal audits, external audits, and regulatory examinations by providing technical evidence, documentation, and subject matter expertise.
Ensure security controls, processes, and monitoring activities align with regulatory expectations, industry standards, and organizational policies.
Assist in validating the effectiveness of security controls through testing, reviews, and remediation tracking.
Maintain appropriate records and documentation to demonstrate compliance with applicable regulatory and security requirements.