Lead, Infrastructure Security Engineer
About The Position
The Lead, Infrastructure Security Engineer owns vulnerability management from scanning and prioritization through remediation tracking, reporting, and exception management. The role deploys and maintains credentialed scanning infrastructure across servers, network devices, and endpoints; develops risk-based prioritization frameworks; and partners with Infrastructure and IT on remediation tracking and service-level reporting. The position secures on-premises infrastructure, including Active Directory, Windows and Linux servers, network systems, remote access, and manufacturing environments. It establishes secure configuration baselines, coordinates patching and change management, assesses new infrastructure deployments and third-party integrations, and maintains network security documentation. It also addresses legacy and operational technology assets that cannot be patched or upgraded through measures such as microsegmentation, compensating controls, monitoring, and decommission planning, while coordinating with Quality/Regulatory on FDA-validated system constraints. The role requires at least four years of progressive experience in infrastructure security, security engineering, or a related cybersecurity field. A relevant bachelor's degree is preferred, though equivalent professional experience or an in-progress degree is considered. Relevant industry certifications and experience in medical devices, healthcare, or regulated industries are preferred.
Requirements
- At least 4 years of progressive experience in infrastructure security, security engineering, or related cybersecurity roles.
- Demonstrated vulnerability management experience, including deployment and operation of scanning platforms, credentialed scanning, and risk-based prioritization.
- Strong Active Directory and Windows Server security knowledge, including tiered administration, GPO, service account management, and domain hardening.
- Network security expertise, including segmentation, firewall management, IDS/IPS, VPN, and routing/switching security.
- Experience with secure configuration baselines such as CIS Benchmarks or DISA STIGs, and with compliance scanning.
- Strong communication and collaboration skills.
Nice To Haves
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field; equivalent professional experience or an in-progress degree is also considered.
- Industry certifications such as CISSP, CompTIA Security+, CySA+, GIAC GSEC, GCSA, or equivalent.
- Medical device, healthcare, or regulated industry experience.
Responsibilities
- Own the vulnerability management lifecycle, including scanning, prioritization, remediation tracking, reporting, and exception management.
- Deploy and maintain vulnerability scanning infrastructure, including credentialed scanning across servers, network devices, and endpoints.
- Develop risk-based prioritization frameworks that account for asset criticality, exploit availability, and business context.
- Build remediation tracking and SLA reporting processes in partnership with Infrastructure and IT teams.
- Manage vulnerability exception and risk acceptance workflows.
- Secure on-premises Active Directory through tiered administration, GPO hardening, service account hygiene, and privileged group management.
- Implement and maintain secure configuration baselines for Windows and Linux servers.
- Coordinate patching schedules and change management with Infrastructure teams to remediate vulnerabilities without disrupting operations.
- Conduct security assessments for new infrastructure deployments and third-party integrations.
- Implement and maintain network segmentation, including VLANs, firewall policies, IDS/IPS, and access control lists.
- Secure remote access infrastructure, including VPNs, jump boxes, and privileged access management.
- Partner with the Infrastructure team on network architecture reviews and security hardening.
- Maintain documentation of network security architecture, diagrams, and configurations.
- Secure legacy and manufacturing-floor environments that cannot be patched or upgraded using microsegmentation, compensating controls, and risk acceptance documentation.
- Implement monitoring for unmanaged and OT assets, including device inventory, network isolation, and anomaly detection.
- Partner with Quality/Regulatory on FDA-validated system constraints and re-qualification requirements.
- Drive decommission planning for end-of-life systems.
Benefits
- Comprehensive health, dental, and vision insurance.
- 401(k) with company match.
- Paid time off (PTO) and holidays.
- Ongoing training and professional development opportunities.
- Opportunity to grow within a fast-paced, dynamic company.
- Potential for bonuses and incentives.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
