Security Engineer

DHRM•Richmond, VA

2d•Hybrid

About The Position

The Virginia Workers' Compensation Commission (VWC) is seeking an Information Security Engineer to help strengthen and evolve cybersecurity operations across the agency. This is an excellent opportunity for an information security professional who enjoys hands-on engineering, solving complex technical challenges, defending enterprise systems, and working with a broad range of modern security technologies in a collaborative, mission-driven environment. Working closely with the Information Security Officer (ISO), Security Analyst, and Information Systems teams, you'll play an important role in protecting the Commission's technology environment while helping support the systems and services that benefit Virginia's workforce. If you enjoy balancing technical problem-solving with continuous learning, collaborating with others, and making a meaningful impact through public service, we encourage you to apply.

Requirements

Experience supporting enterprise information security, cybersecurity, systems administration, or related technology environments.
Working knowledge of information security principles, risk management, and cybersecurity best practices.
Experience with one or more enterprise security technologies such as SIEM, EDR, IAM, vulnerability management, endpoint protection, network security, or cloud security solutions.
Experience analyzing security events, troubleshooting technical issues, and assisting with incident response activities.
Knowledge of information security frameworks, standards, or regulatory requirements.
Strong analytical, problem-solving, and organizational skills.
Excellent written and verbal communication skills with the ability to explain technical concepts to both technical and non-technical audiences.
Ability to work independently while collaborating effectively within a team environment.

Nice To Haves

Experience and/or working knowledge of Microsoft security technologies, including Microsoft Defender, Microsoft Entra ID, Microsoft Purview, or Microsoft Sentinel.
CrowdStrike Falcon or similar endpoint detection and response platforms.
Splunk or other SIEM platforms.
Identity and Access Management (IAM) and Privileged Access Management (PAM).
Vulnerability management and security assessment tools.
Security governance, risk management, compliance, or audit support.
Scripting or automation using PowerShell, Python, or similar languages.
Experience supporting state government or other regulated environments.
Industry certifications such as Security+, CySA+, CISSP, GIAC, Microsoft Security certifications, or equivalent.
Commonwealth of Virginia experience preferred.

Responsibilities

Configuring, maintaining, tuning, and optimizing enterprise security technologies, including but not limited to Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Privileged Access Management (PAM), Data Loss Prevention (DLP), vulnerability management, and security monitoring platforms.
Monitoring security events, analyzing threats and trends, troubleshooting security technologies, and supporting incident investigations and response activities.
Assisting with vulnerability assessments, security configuration reviews, and remediation efforts to help ensure compliance with Commission and Commonwealth security standards.
Supporting the Commission's information security governance and compliance program by assisting with Business Impact Analyses (BIA), Risk Assessments, System Security Plans, Incident Response Planning, Continuity of Operations Planning (COOP), and security policies and procedures.
Assisting with oversight of third-party service providers to help ensure compliance with Commission and Commonwealth information security requirements.
Collaborating with Information Systems staff and business partners to implement secure technology solutions and strengthen the Commission's overall cybersecurity posture.
Supporting ongoing security improvements through documentation, process enhancement, and implementation of cybersecurity best practices.