SecOps Engineer

Open Approach•Burlington, VT

1d•$85,000 - $105,000•Onsite

About The Position

Open Approach is hiring a SecOps Engineer to build, improve, and evolve security systems and processes for the company and its clients. This is not a traditional, dashboard-focused SOC position. The engineer will serve as the primary escalation point for the Security Operations Analyst, own complex investigations, and lead advanced incident response. The role also focuses on designing, implementing, and optimizing security platforms, including SIEM, EDR, and vulnerability management; improving detection; researching and evaluating tools; and automating manual processes. The engineer will support the technical implementation and validation of compliance controls for frameworks such as CMMC, HIPAA, and CJIS, and help mature the Security Operations program. Open Approach describes itself as a values-driven, client-focused IT services company based in Burlington, Vermont, serving organizations across New England and beyond.

Requirements

At least 3 years of cybersecurity experience; experience with an MSP is preferred, or prior MSP experience outside cybersecurity.
Working understanding of firewalls, IDS/IPS, endpoint protection, and other core security technologies.
Ability to analyze security events and incidents, identify threats, patterns, and vulnerabilities, and investigate and resolve incidents thoroughly.
Ability to uphold operational and security standards and identify where they are not being met.
Interest in keeping current with new technologies, trends, and best practices.
Ability to prioritize effectively when incidents or projects compete for attention.
Understanding of maintaining standards, managing change, and building repeatable processes.
Understanding of Active Directory architecture, including users, groups, and computer objects, with a security focus; experience with Group Policy design and management; familiarity with hybrid identity synchronization between on-premises AD and Azure/Entra ID; and ability to identify and address common identity and access risks.
Strong grasp of networking fundamentals, including DHCP, DNS, routing, and switching, and their relationship to security; familiarity with SSL VPN and IPSec VPN; understanding of segmentation, least privilege, and traffic-flow analysis; and ability to troubleshoot network-related security issues.
Strong understanding of Microsoft 365 and Intune security capabilities, including device management, policy enforcement, Conditional Access, authentication methods, and identity protection; familiarity with email security, mail flow, and security-platform integration; and ability to assess and improve Microsoft cloud security posture.
Hands-on experience with SIEM, EDR, IDS/IPS, firewalls, and vulnerability management tools; ability to analyze alerts, investigate incidents, and track threats across platforms; understanding of alert tuning, noise reduction, detection, and response; familiarity with vulnerability assessments and risk analysis; and basic understanding of cryptographic concepts and their practical applications.
Experience with incident response processes, including triage, containment, investigation, and recovery; ability to analyze complex incidents, determine root cause, drive remediation, and reduce impact while improving future response.
Clear communication with technical and non-technical audiences, strong collaboration, curiosity, and an ability to own complex problems from start to finish are emphasized in the role description.

Nice To Haves

Familiarity with Hyper-V or VMware, including security isolation, snapshotting, investigation workflows, and testing or validating security configurations in virtualized environments.
Understanding of firewall technologies, rule creation, and policy management, with the ability to implement best-practice rules and troubleshoot traffic.
Understanding of public and private DNS architecture; knowledge of A, CNAME, MX, SPF, DKIM, and TXT records and their role in email security; and comfort troubleshooting DNS using command-line and diagnostic tools.
Working knowledge of NIST, CIS, and ISO frameworks; familiarity with compliance-driven environments and mapping technical controls to regulatory requirements; and ability to support controls for CMMC, HIPAA, or CJIS.
Relevant certifications such as Security+, Microsoft Security (SC-series), or similar foundational cybersecurity and cloud certifications. Advanced certifications such as CISSP or CCSP are a plus for experienced candidates.

Responsibilities

Act as the escalation point for complex security incidents and investigations.
Design, implement, and optimize security tools and platforms, including SIEM, EDR, and vulnerability management tools.
Lead advanced incident response investigations, containment, and remediation.
Develop automation and improve processes to reduce manual effort and increase efficiency.
Research and evaluate security tools and technologies.
Tune alerts, reduce false positives, and improve detection capabilities.
Support compliance initiatives through technical control implementation and validation.
Collaborate with internal teams to ensure security solutions are properly deployed and maintained.
Create and maintain documentation, standards, and repeatable processes.
Contribute to the ongoing maturity of the Security Operations program.

Benefits

Health insurance with generous employer contributions
Dental insurance with generous employer contributions
Vision insurance with generous employer contributions
Company-sponsored life insurance
Company-sponsored short- and long-term disability coverage
Workers’ Compensation
401(k) with 4% match starting day one
Generous PTO starting at 16 days, plus paid holidays; 20 days on the one-year anniversary
Fully paid parental leave
Smartphone stipend for on-call rotation
Weekly company lunches, coffee, and snacks
Pet-friendly office