Security Engineer

Sperry Rail • Shelton, CT

11d • Hybrid

About The Position

Security at Sperry is run today by our Global IT team, alongside everything else that team carries. The tooling is in place and the practice around it is real. What it has not had is someone whose primary job it is, and that is the seat we are hiring. You will work across our security stack day to day: endpoint detection and response, vulnerability management, and the identity and access configuration across Microsoft 365 and Entra ID. You will also help mature the practice around those tools, including the runbooks, the asset inventory, the incident handling, and the measures that tell us whether any of it is working. This is a hybrid role by design, and worth being straightforward about. We run a lean Global IT team where everyone wears several hats. You will be our specialized hand on security, and you will also work side by side with the team on general infrastructure and endpoint administration. That breadth is part of the appeal: you will see the whole environment rather than one slice of it, and you will keep building your cloud and infrastructure skills while you are here. We are hiring experience deliberately. This seat carries real responsibility for the security posture of a company that inspects track for most of the major railroads in North America, and what we are looking for is someone who arrives with a view of how this should be done and is willing to challenge how we do it today.

Requirements

• Five or more years in systems administration or IT infrastructure with a substantial security focus, or a cybersecurity degree with equivalent hands-on experience
• Solid foundational knowledge of Windows Server and desktop environments
• Hands-on experience with cloud infrastructure in Azure or AWS, and comfort working across both
• Experience managing and supporting users in Microsoft 365, including identity and access configuration
• Experience with enterprise-grade security appliances such as firewalls and routers
• Practical vulnerability management experience: scanning, prioritization, and driving remediation with teams who do not report to you
• Scripting for automation of routine tasks (PowerShell, Python, or similar)
• Sound judgment about risk, and the ability to explain a security decision to a non-technical audience
• A collaborative, team-first mindset aligned with our values of being Humble, Hungry, and Smart

Nice To Haves

• Direct experience with Rapid7, SentinelOne, or comparable vulnerability management and XDR platforms
• Experience with central IT management platforms such as ConnectWise Automate
• Working experience with ISO 27001; exposure to NIST, SOC 2, or ITIL is an asset
• Security certifications (CISSP, CISM, Security+, AZ-500, AWS Security Specialty, or similar)
• Device management tooling (Intune or equivalent)
• Experience as the dedicated security specialist on a small IT team
• Experience in an operational or industrial environment where availability and safety carry weight
• Experience in rail testing, NDT, or sensor-based inspection industries (ultrasound, eddy current, electromagnetic, etc.)

Responsibilities

• Own the deployment, configuration, and daily monitoring of our vulnerability management platform, and drive patching and remediation to closure across a predominantly Windows environment
• Monitor, tune, and report on endpoint detection and response coverage, and lead the response when something is found
• Perform root cause analysis on security incidents and see corrective actions through
• Scope and coordinate penetration testing and remediation with external partners
• Maintain security runbooks, asset inventories, and incident logs
• Administer and harden Microsoft 365 and Entra ID, with a focus on secure configuration, conditional access, and mail security
• Build the access model for third-party SaaS used across enterprise systems and engineering, so that permissions match roles rather than accumulate
• Support device management and compliance across the fleet
• Align IT processes, documentation, and controls with ISO 27001 and other relevant frameworks
• Support customer security assessments and questionnaires, and own the technical answers in them
• Establish and maintain security posture KPIs that show whether the program is improving, and report them to IT and digital leadership
• Contribute to security policy, including acceptable use of AI tools and SaaS
• Own the configuration and maintenance of security appliances including firewalls and routers
• Use our central IT management platform for software deployment, patching, scripting, and remote troubleshooting
• Support provisioning, imaging, and deployment of Windows laptops and workstations
• Assist with troubleshooting and user access provisioning for core business systems
• Automate routine work rather than repeating it
• Take on the vulnerability queue and establish a working remediation cycle with the infrastructure team
• Stand up device management and compliance reporting across the fleet
• Scope and run the external penetration testing program, and turn the findings into a prioritized plan
• Take ownership of the technical response to customer security assessments
• Establish security posture KPIs, put them in front of leadership, and define what good looks like for the year after
• Move us toward ISO 27001 alignment, starting with the controls that matter most

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: Associate degree