Infrastructure Engineer, Senior

Southland Industries•Carrollton, TX

4d•Hybrid

About The Position

Security Operations is a key part of Southland’s cybersecurity program, supporting monitoring, response, tooling, workflows, and coordination to help protect the company from cyber threats. The Senior Infrastructure Engineer helps improve threat detection, incident response, operational risk management, and security workflows across users, endpoints, servers, cloud services, and business systems. The role works hands-on with cybersecurity, IT, infrastructure, support, vendors, and business teams to investigate alerts, respond to incidents, follow up on vulnerabilities, and improve operational workflows. It turns security events into clear action, documentation, and remediation. The position investigates alerts from EDR, SIEM, email, identity, vulnerability, cloud, and endpoint tools; supports incident scoping, containment, remediation, and recovery; and coordinates response work with technical and business owners. It also supports security tool tuning, automation, dashboards, playbooks, data quality, change management, documentation, and continuous improvement. This is a hybrid role available to candidates located near Southland’s active locations and sites listed in the posting. Southland Industries is an employee-owned MEP company founded in 1949. Employment offers are contingent on successful drug tests, background checks, and professional reference checks. Roles requiring driving as an essential duty require a successful Motor Vehicle Record check. Employment sponsorship is not available.

Requirements

Minimum 4–6 years of experience in cybersecurity, security operations, incident response, IT operations, networking, or a related role.
Strong hands-on security operations, incident response, threat detection, or vulnerability experience.
Experience with EDR, SIEM, email security, identity security, vulnerability management, ITSM, or similar tools.
Solid understanding of alert triage, endpoint security, identity risk, cloud security, and response workflows.
Experience supporting investigations, incidents, vulnerabilities, tool tuning, or process improvement.
Ability to work well with business stakeholders and technical teams.
Strong communication skills and a practical, straightforward approach.
Ability to assess technical issues, make sound recommendations, and keep work moving.

Nice To Haves

Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or a related field is preferred.
Experience with MSSP coordination, incident playbooks, SIEM tuning, or automation.
Interest in tools that improve visibility, automation, reporting, and day-to-day execution.

Responsibilities

Build relationships with cybersecurity, IT operations, infrastructure, support, vendors, and business teams, serving as a hands-on resource for questions, escalations, incidents, and follow-up.
Work with technical owners to clarify investigation steps, impact, and next actions.
Investigate alerts from EDR, SIEM, email, identity, vulnerability, cloud, and endpoint tools by reviewing alert details, logs, user activity, endpoint data, and related context.
Escalate issues clearly when an incident, containment action, or business decision is needed, and document findings, decisions, and next steps.
Support incident response activities, including scoping, containment, remediation, and recovery follow-up.
Coordinate with IT, support, infrastructure, and business owners during response and remediation work.
Follow vulnerabilities, misconfigurations, exposure, and operational findings through closure.
Use and support security operations tools, including EDR, SIEM, email security, identity security, vulnerability management, and ITSM platforms.
Support tuning, automation, dashboards, playbooks, and data quality improvements, connecting alerts, tickets, evidence, ownership, and remediation status across tools.
Support rollout of security tools, monitoring practices, response processes, and operational standards; communicate changes, gather feedback, identify issues, and recommend adjustments.
Support testing, training, and readiness before new tools or processes go live.
Document investigations, incident notes, playbooks, runbooks, escalation paths, and decision points; maintain accurate operational data in dashboards, tickets, alerts, and response records.
Provide day-to-day guidance on triage, response, vulnerabilities, and operations questions; share knowledge and help maintain consistent procedures and handoffs.
Identify patterns in alerts, vulnerabilities, incidents, and recurring operational issues, and recommend improvements to detections, playbooks, dashboards, automation, and workflows.
Support planning for operations maturity, MSSP/vendor coordination, tooling, and automation, and keep up with relevant threat, detection, response, and vulnerability management practices.

Benefits

401(k) plan with 50% company match, no cap, and immediate 100% vesting.
Medical, dental, and vision insurance, 100% paid for the employee.
Annual bonus program based on performance, achievement, and company profitability.
Term life, AD&D insurance, and voluntary life insurance.
Disability income protection insurance.
Pre-tax flexible spending plans for health and dependent care.
Paid parental leave.
Paid holidays, vacation, and personal time.
Training and professional development opportunities.
Company-paid memberships for professional associations and licenses.
Wellness benefits.