Junior Security Engineer

Virginia Commonwealth University•Richmond, VA

6d•$69,000 - $71,000•Hybrid

About The Position

The Junior Security Engineer supports the University's enterprise cloud security platform, with primary responsibility for Data Loss Prevention (DLP) and the Secure Access Service Edge platform. This role also performs Security Operations Center (SOC) functions, monitoring, triaging, and investigating alerts generated across the University's broader security toolset, including SIEM, endpoint detection, antivirus, firewall, authentication, and network-monitoring systems, and assisting with containment and incident response. The Junior Security Analyst builds and tunes security policies that protect institutional data and enforce secure, least-privilege access for faculty, staff, students, and affiliates; troubleshoots connectivity and access issues reported by end users; and partners with the network engineering, systems, and security teams to keep the University's hybrid environment secure and reliable.

Requirements

Basic knowledge of cybersecurity principles and common attack methods, including phishing, malware, credential theft, unauthorized access, and account compromise.
Solid foundational knowledge of TCP/IP networking, the OSI model, DNS, HTTP/HTTPS, firewalls, and TLS/SSL/PKI concepts.
Familiarity with Windows, Linux, or macOS operating systems.
Familiarity with access control, authentication, multifactor authentication, and least-privilege principles.
Basic knowledge of incident-response processes, including triage, containment, and escalation.
Familiarity with SIEM, endpoint protection, antivirus, ticketing, or network-monitoring systems.
Skill in analyzing log files and security-event data to identify actionable incidents and reduce alert fatigue.
Knowledge of Zero Trust Network Access (ZTNA) principles and Secure Access Service Edge (SASE) architecture.
Knowledge of data privacy regulations relevant to higher education (FERPA) and, where applicable, HIPAA, GLBA, and PCI DSS.
Awareness of confidentiality requirements and proper evidence handling when addressing sensitive institutional data and security investigations.
Strong analytical and problem-solving skills, with the ability to communicate technical information clearly to both technical and non-technical audiences.
Ability to work independently and collaboratively within a team, following established change management and documentation practices.
Working knowledge of Data Loss Prevention concepts, including policy creation, alert triage, and rule tuning.
Demonstrated ability to work in and foster an environment of respect, professionalism and civility with a population of faculty, staff, and students from all backgrounds and experiences, or a commitment to do so as a staff member at VCU.

Nice To Haves

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field; or an equivalent combination of education, training, and experience.
Minimum of one to two years in network administration, information security, security operations, or a related IT discipline.
Experience configuring and supporting cloud-based security platforms (e.g., SASE, Secure Web Gateway, ZTNA solutions)
Industry certification such as CompTIA Security+, Network+, CySA+
Prior experience in a Security Operations Center (SOC) or a security monitoring/incident-response role.
Scripting or automation experience (PowerShell, Python, or similar) to support security operations.
Hands-on experience configuring or administering SIEM, EDR, or SOAR platforms.
Demonstrated experience in troubleshooting enterprise network and application connectivity issues.

Responsibilities

Design, build, and maintain DLP policies within our SSE to detect and prevent unauthorized transmission or exposure of sensitive institutional data, including FERPA-protected student records, personally identifiable information (PII), financial data, and research data.
Monitor, triage, and investigate DLP alerts, distinguishing true-positive incidents from false positives, and escalate confirmed data-loss events in accordance with incident response procedures.
Continuously tune DLP rules, dictionaries, and detection thresholds to reduce false positives while maintaining effective coverage of sensitive data types.
Document DLP incidents, investigative findings, and remediation actions, and maintain metrics on policy effectiveness and alert volume.
Administer and support the University's SSE environment.
Create, configure, and manage SSE access policies and rules to enforce zero-trust-based least-privilege access to internal applications and systems.
Create and manage SSE SSL/TLS inspection policies, firewall policies, and DNS policies to secure inbound and outbound traffic from university endpoints.
Use SSE performance monitoring tools to inspect application and network performance, proactively identifying and resolving access and performance issues affecting end users.
Provide escalated (Tier 2/3) troubleshooting support for end-user connectivity, access, and performance issues related to the SSE platform, working directly with faculty, staff, and students as needed.
Support deployment, configuration, and maintenance of SSE client application, access infrastructure, and related platform components.
Serve as a technical resource for the Information Security team, IT service desk, and network engineering staff on SSE-related matters, including SSO, MFA, among other broader infrastructure.
Collaborate with network engineering and systems administration teams to integrate SSE services with existing network and system architecture.
Develop and maintain technical documentation, including architecture diagrams, configuration standards, and operational runbooks.
Recommend enhancements to security policies, standards, and procedures based on emerging threats, platform capabilities, and industry best practices.
Monitor alerts generated by security information and event management (SIEM), endpoint detection and response (EDR), antivirus, firewall, authentication, and network-monitoring systems.
Perform initial review and triage of cybersecurity alerts, determining whether reported activity is benign, suspicious, or potentially malicious.
Investigate phishing messages, malware detections, suspicious logins, compromised accounts, and unusual endpoint or network activity.
Collect and correlate relevant information from system logs, user accounts, endpoints, authentication systems, and network-security tools to support investigations.
Document security alerts, investigative findings, affected systems, and response actions in the incident-tracking system.
Escalate serious or technically complex incidents to senior analysts or management in accordance with established escalation procedures.
Assist with containment actions, including isolating endpoints, disabling compromised accounts, blocking malicious indicators, and notifying affected IT personnel.
Communicate with students, faculty, staff, and technical teams throughout the course of security investigations.
Maintain incident tickets and supporting documentation across the investigation lifecycle.
Assist with updating incident-response procedures and analyst playbooks based on lessons learned.
Identify recurring false positives generated by SOC monitoring tools and recommend alert-tuning improvements.
Remain informed about current phishing campaigns, malware, vulnerabilities, and other cybersecurity threats relevant to higher education.
Participate in an on-call rotation to support security incidents, planned maintenance windows, and platform upgrades outside standard business hours.
Develop and update annual security awareness course material for the University.