Security Engineer

Sargent & Lundy•Chicago, IL

4d•Hybrid

About The Position

Sargent & Lundy is seeking a Security Engineer with a strong data and analytics mindset to help operate and mature our security platforms, data protection capabilities, and Zero Trust architecture. In this role, you will work hands-on with tools such as Azure, CrowdStrike, Mimecast, Zscaler, DLP platforms, Secret Server, and cloud security services to support day-to-day operations, configuration management, incident response, and security analytics. You will also contribute to our evolving AI security guardrails, helping the organization adopt AI responsibly while protecting our data and clients. This position is ideal for someone early in their security career who is passionate about building secure cloud infrastructure, enjoys working with data and building repeatable reports and dashboards, is curious about AI security, data protection, and modern cloud security models, and wants to grow into a broader engineering and architecture role over time.

Requirements

Security Platforms & Technologies: Endpoint security and EDR tools (e.g., CrowdStrike, Palo Alto). Email security and secure email gateways (e.g., Mimecast, Microsoft). Secure web gateways / cloud proxy solutions (e.g., Zscaler, WAF, Palo Alto). DLP solutions (Purview, ZScaler). Secret Server or comparable privileged access management tools. Identity platforms and IAM concepts (e.g., Entra ID, SSO, MFA, RBAC). Basic understanding of cloud security concepts (CSPM, security groups, identity-based access in cloud providers).
Data & Analytics Skills: Strong proficiency with Microsoft Excel (vLOOKUP/XLOOKUP, INDEX/MATCH, pivot tables, charts, data cleanup). Experience building and maintaining Power BI reports and dashboards (data models, measures, filters, visualizations). Ability to interpret logs, alerts, and data sets from multiple tools and summarize key insights and recommended actions.
Essential Qualifications: Bachelor’s degree in computer science, information systems, cybersecurity, data analytics, or a related field; or equivalent practical experience. 1–3 years of experience in IT, security operations, or data analytics, including internships, co-ops, or relevant project work. Proven ability to work with large data sets and translate findings into clear, actionable recommendations. Strong written and verbal communication skills, with the ability to document processes and explain technical concepts to non-technical stakeholders.
Behaviors & Mindset: Gives direct and constructive feedback with the goal of improving outcomes for the team and the business. Shows curiosity and a learning mindset, asking questions to understand the “why” behind processes and decisions. Prioritizes team success over individual credit, actively collaborating across IT, Security, and business functions. Owns commitments, follows through on assigned tasks, and proactively communicates risks, blockers, or delays. Treats mistakes and near-misses as learning opportunities, helping to improve processes and documentation. Is motivated by impact, connecting daily work to protecting our people, clients, and projects.

Nice To Haves

Experience with CrowdStrike, Mimecast, Zscaler, DLP platforms, Secret Server, or similar tools in a production environment.
Exposure to security frameworks or best practices (e.g., NIST CSF, ISO 27001, CIS Controls).
Prior involvement in incident response, security monitoring, or SOC functions.
Familiarity with AI tools, large language models, or data science workflows, particularly as they relate to security and governance.
Basic knowledge of cloud security concepts in Azure (or similar cloud infrastructure)

Responsibilities

Assist with Endpoint Detection and Response (EDR) configuration, policy tuning, and device control management, including exception handling and reporting.
Support Mail Security configuration management (email security policies, spam/phishing controls, DLP rules) and maintain accurate documentation of changes.
Help manage Internet Security configurations and policies (web filtering, SSL inspection, access controls, and user/device policy alignment).
Contribute to DLP management, including rule tuning, incident review, false-positive reduction, and user outreach.
Maintain and update data repository inventories (file servers, cloud storage, SaaS apps) to support DLP, access reviews, and risk assessments.
Analyze data flows, access patterns, and DLP/endpoint events to identify trends and drive remediation.
Assist in defining and monitoring data classification and protection controls across on-prem and cloud environments.
Support IAM governance activities including user access reviews, role analysis, and exception tracking.
Help manage and monitor Privilege Access Management usage, including access requests, vault hygiene, and reporting.
Participate in efforts to align IAM controls with Zero Trust principles (least privilege, continuous verification, just-in-time access).
Assist in maintaining cloud security posture (Azure, AWS, or other cloud environments) by reviewing configuration baselines and security findings.
Help document and track decisions from the Architecture and Design Review Board for cloud services and custom applications.
Support Zero Trust governance by helping document policies, control mappings, and implementation status across identity, endpoint, network, and data.
Help operationalize threat intelligence by correlating threat feeds with internal telemetry (CrowdStrike, Zscaler, Mimecast, logs) and assisting in enrichment of alerts.
Participate in incident response activities as an analyst/engineer: data collection, initial triage, impact analysis, documentation, and lessons-learned tracking.
Assist in building reusable playbooks, including data queries, Excel/Power BI templates, and checklists.
Contribute to AI enablement by inventorying AI tools, helping define and document guardrails, and supporting monitoring and reporting on AI-related data access.
Partner with security leadership and data teams to ensure AI solutions enable innovation while protecting sensitive data.
Maintain up-to-date SOPs, configuration standards, and runbooks for supported tools and processes.
Participate in efforts to automate recurring tasks (reporting, reviews, alert triage) using scripts, queries, or low-code tooling where appropriate.
Provide clear, concise summaries of findings, risks, and recommended actions for both technical and non-technical stakeholders.