Security Engineer

Watsco, Inc.•Miami, FL

19h

About The Position

Watsco Inc. is seeking a Security Engineer to operate and continuously improve cybersecurity monitoring, incident response, vulnerability management, email and endpoint security, cloud and identity controls, risk management, and security assurance. The role partners with IT owners and a managed detection and response (MDR) provider to reduce risk while maintaining independent review of security controls. The Security Engineer oversees security monitoring and investigations, leads technical incident response, runs the vulnerability-management program, administers email security, and defines and validates identity, endpoint, and infrastructure security requirements. The role also reviews technology changes and configurations, maintains security policies and audit evidence, assesses vendors and third parties, and delivers security awareness and response-readiness activities. The position may require scheduled after-hours work, incident-response participation, and local travel. Duties may evolve with business needs. Reasonable accommodations will be provided in accordance with applicable requirements.

Requirements

4+ years of cybersecurity engineering, security operations, incident response, vulnerability management, or equivalent defensive-security experience.
Hands-on knowledge of SIEM, EDR, email security, identity and cloud security, vulnerability scanning, network security, Windows environments, and incident investigation.
Ability to analyze logs and alerts, communicate risk clearly, preserve evidence, write policies/runbooks, and coordinate technical remediation across owners and vendors.
Working knowledge of common security frameworks and controls, least privilege, segmentation, secure configuration, risk treatment, and audit evidence.
Ability to participate in after-hours incident response and handle sensitive information with discretion.

Nice To Haves

Experience with Microsoft Defender, Entra ID, Microsoft 365, Proofpoint, cloud security, MDR/SOC operations, scripting, and multi-site environments.
Relevant Security+, CySA+, GCIH, GCIA, CISSP, CCSP, Microsoft Security, or comparable certification.
Experience with NIST CSF, CIS Controls, ISO 27001, PCI DSS, privacy obligations, or customer assurance programs as applicable.

Responsibilities

Operate or oversee SIEM, EDR, email-security, identity, cloud, and MDR monitoring; investigate alerts, tune detections, validate logging coverage, and escalate material events.
Lead technical incident response, including triage, containment, evidence preservation, partner coordination, recovery support, post-incident review, and corrective-action tracking.
Run the vulnerability-management program by maintaining scan coverage, risk-ranking findings, assigning remediation, managing time-bound exceptions, rescanning, and reporting overdue exposure.
Administer Proofpoint security policy and investigate phishing; manage blocking, whitelisting, impersonation protection, SPF/DKIM/DMARC coordination, and security-related release escalations.
Define and validate MFA, SSPR, Conditional Access, privileged access, account recovery, access review, and compromised-account requirements in partnership with Infrastructure.
Define endpoint/server hardening, EDR, encryption, logging, and isolation requirements; validate remediation performed by Service Delivery and Infrastructure.
Review segmentation, firewall rules, remote access, cloud configurations, internet-facing services, new applications, architectures, and significant technology changes.
Maintain security policies, standards, risk register, exceptions, metrics, audit evidence, customer/security questionnaires, cyber-insurance support, and remediation plans.
Assess critical vendors, partner access, SaaS/cloud services, contractual security requirements, and third-party remediation.
Deliver role-based awareness, phishing exercises, incident runbooks, tabletops, and cross-training; coordinate MDR, forensic, penetration-testing, and specialist partners.