Security Engineer

EXPANSEFT INC • Village of Westbury, NY

61d • $90,000 - $130,000 • Remote

About The Position

ExpanseFT is hiring its first dedicated Security Engineer to become the primary operator of its day-to-day security program. The role reports to the EVP, Platform & Technology and is a hands-on, queue-owning position responsible for investigating alerts, tuning detections, running vulnerability cycles, coordinating audits, conducting access reviews, and maintaining defensible compliance evidence.

The Security Engineer will operate security across a hybrid environment spanning AWS, Azure, and an on-premises data center. The environment includes cloud SIEM and XDR, EDR, cloud-native security services, automated patch management, enterprise identity and access governance, Jira Cloud workflows, and on-premises network segmentation. The position supports a mature security program with incident response, formal change control, and annual third-party assessment.

The role includes participation in the security on-call rotation and periodic, event-driven on-site visits to the Long Island data center. The position is described as remote but NY-based; visits may be for scheduled physical-security duties or incident response, rather than a regular commute.

Requirements

• 4+ years in Security Operations (L2/L3), Security Engineering, or a closely related role in a regulated environment such as payments, finance, or healthcare, or an equivalent environment.
• Hands-on experience operating AWS security services such as Security Hub, GuardDuty, Inspector, and IAM in a multi-account setup.
• Hands-on experience with a cloud SIEM, including KQL or equivalent query fluency, and the ability to write and tune analytics rules.
• Experience administering an EDR platform such as SentinelOne, Defender for Endpoint, CrowdStrike, or an equivalent.
• Demonstrable experience running a vulnerability management lifecycle under SLA, including scanning, triage, evidence, and remediation tracking.
• Working knowledge of PCI DSS v4.0, particularly requirements 5, 7, 8, 9, 10, 11, and 12, or substantively equivalent experience with SOC 2, ISO 27001, HITRUST, or NIST CSF.
• Proficiency in at least one scripting language for operations automation: Python, Bash, or PowerShell.
• Comfort with jq, AWS CLI, and az CLI.
• Strong written communication skills for tickets, runbooks, and audit evidence.
• Ability to work the queue independently, prioritize under SLA pressure, and escalate proactively.
• Ability to operate a comparable security stack at a comparable scale in a regulated environment; hands-on experience with every listed product is not required.

Nice To Haves

• One or more of the following certifications: CISSP; GIAC (GCIH, GCED, GMON, GCDA, GSEC); AWS Security Specialty; Azure Security Engineer Associate (AZ-500); or CompTIA CySA+.
• Prior experience as the evidence point of contact on a PCI DSS QSA engagement.
• Experience with open-source cloud security assessment tools such as Prowler, Steampipe, CloudQuery, cfn-nag, checkov, tfsec, or trivy.
• Experience reading or contributing to AWS CDK (TypeScript) or Terraform.
• Experience with a next-generation firewall platform such as Cisco FTD/FMC, Palo Alto, Fortinet, or equivalent.
• Experience on a formal on-call rotation using PagerDuty, Opsgenie, or equivalent.

Responsibilities

• Own the daily security operations queue; triage and investigate alerts and findings across cloud SIEM, XDR, EDR, and cloud-security-posture tooling, and drive them to closure with documented evidence.
• Operate the vulnerability management lifecycle, including quarterly external ASV scans, internal authenticated scans, container and Lambda scanning, dependency alerts, and penetration-test follow-through; track remediation against SLA.
• Administer endpoint protection across the endpoint fleet, including agent deployment, policy tuning, detection quality, and threat response.
• Run the access-review program across identity providers, covering user, privileged, service-account, and third-party access; verify terminated-user revocation and execute provisioning and deprovisioning.
• Lead incident response as the primary responder for security events, including containment, forensics, communications, and post-incident review, with executive escalation where warranted.
• Own the PCI DSS evidence program by collecting, labeling, and retaining evidence for the annual QSA assessment, and serve as the QSA's primary operational point of contact during fieldwork.
• Contribute to detection engineering by writing and tuning SIEM analytics rules, improving signal-to-noise on high-volume detections, and proposing automation improvements.
• Participate in on-call support for security alerts, including out-of-hours escalation.
• Deliver annual security-awareness training and support the quarterly personnel review process.
• Support data-center physical security on a periodic, on-site basis, including visitor logs, device inspections, media destruction, and rogue-wireless detection.

Benefits

• Annual training and certification budget allocated for at least one major security certification.
• Security conference attendance each year.
• ExpanseFT standard benefits package; specific benefits are not listed.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level