IT Security Lead

Whippany Actuation Systems•Whippany, NJ

3d•$145,000 - $170,000

About The Position

Whippany Actuation Systems, an aerospace manufacturer specializing in electromechanical actuators for commercial and military applications, is seeking a hands-on cybersecurity professional to build, operate, and continuously strengthen its internal security program. The role spans security operations, identity and access management, endpoint and network defense, vulnerability management, vendor risk, compliance, incident response, business continuity, and employee security guidance. It is intended for someone with broad IT and security experience who can work independently, coordinate across teams, and grow into a senior internal security role. The position collaborates with internal teams, service providers, and assessors, and participates in an on-call rotation as needed. It is restricted to U.S. persons because it involves access to export-controlled technology; proof of status is required before employment. The position is an at-will role.

Requirements

3+ years in information security, IT operations, or a related field, with hands-on experience across multiple security domains.
Working knowledge of SIEM, EDR, vulnerability scanning, identity providers, cloud platforms, and tools such as CrowdStrike Falcon, Tanium, ThreatLocker, Microsoft Entra ID, or equivalents.
Strong fundamentals in networking, Windows, Active Directory, Microsoft 365, authentication protocols, endpoint management, firewalls, VPNs, and secure configuration.
Practical knowledge of CMMC and protecting Controlled Unclassified Information (CUI) and Federal Contract Information (FCI); familiarity with DFARS, ITAR, export controls, NIST guidance, and ISO/IEC 27001 or comparable frameworks.
Willingness to join an on-call rotation and provide after-hours support as needed.
Authorization to work in the U.S.
U.S. person status (U.S. citizens, permanent residents, and other protected individuals under the Immigration and Naturalization Act, 8 U.S.C. 1324b(a)(3)); proof of status is required before employment.

Nice To Haves

CISSP, CISM, CISA, CRISC, CCIE, CCNP Security, CompTIA Security+, Network+, or comparable certification.
Experience supporting or leading internal, customer, regulatory, or certification audits and managing remediation through closure.
Experience in defense, aerospace, manufacturing, or another regulated environment that handles CUI, FCI, or export-controlled information.
Experience with cloud security posture management and Microsoft GCC High or other regulated cloud environments.
Familiarity with offensive security concepts, penetration-test findings, attack-path analysis, and related tooling.
Experience developing and testing incident-response, ransomware-recovery, disaster-recovery, and business-continuity plans.
Experience coordinating managed security service providers, security consultants, assessors, and third-party review partners.

Responsibilities

Monitor SIEM and EDR alerts, investigate threats, and support incident containment, escalation, and response.
Manage identity and access controls, including SSO, MFA, Active Directory, Microsoft Entra ID, privileged access, employee transitions, and periodic access reviews.
Maintain endpoint security through EDR, patching, secure configurations, software controls, encryption, and exception remediation.
Support network security, including firewalls, access controls, VPNs, segmentation, wireless security, secure configurations, and monitoring.
Coordinate vulnerability scanning, risk-based prioritization, remediation with system owners, closure validation, and reporting.
Support incident response, disaster recovery, and business continuity planning and testing to meet recovery objectives.
Support customer, contractual, and regulatory compliance, including CMMC, DFARS, ITAR and other U.S. export controls; where applicable, NIS2, Cyber Essentials/Plus, CMS, DCPP, ISO/IEC 27001, and GDPR.
Maintain security policies, procedures, plans, risk registers, diagrams, control records, and audit evidence; support customer questionnaires and audits.
Assess supplier and service-provider security risks, review controls, and track remediation and risk acceptances.
Deliver security awareness, role-based training, phishing simulations, and onboarding guidance on incident reporting and CUI/FCI protection.
Advise employees on security questions, suspicious emails, lost devices, access requests, and other concerns.
Evaluate, recommend, implement, and document security technologies, standards, configurations, processes, and runbooks to scale the security program.
Collaborate with internal teams, service providers, and assessors.
Participate in an on-call rotation as needed and provide after-hours support as needed.