Security Engineer

Seyfarth Shaw LLP•Miami, FL

6d•Remote

About The Position

As a Security Engineer – Application Security & Technology Risk, you will help evaluate and protect the Firm's technology environment by assessing the security risks associated with applications, SaaS platforms, browser extensions, integrations, and other technologies proposed for use within the Firm. A significant part of this role will involve understanding how a technology works, the access and permissions it requires, the data it can access or process, how it integrates with the Firm's environment, and how it could potentially be abused or compromised. You will evaluate these technologies from both a defensive and adversarial perspective, considering vulnerabilities, software supply-chain risk, authentication and authorization controls, configuration weaknesses, and the ways an attacker could leverage a compromised application or integration. The successful candidate will combine strong technical security knowledge with the ability to translate security findings into practical, risk-based recommendations for application owners, IT teams, and Firm leadership.

Requirements

At least three years of experience in cybersecurity, security engineering, application security, vulnerability management, penetration testing, security operations, or a related technical information technology role.
Strong understanding of common vulnerabilities, attack techniques, and the ways attackers compromise applications, endpoints, identities, cloud services, and enterprise environments.
Strong understanding of software supply-chain risk, including compromised software updates, malicious dependencies, third-party libraries, browser extensions, package repositories, software signing, and vendor compromise.
Familiarity with offensive security and penetration testing methodologies and the ability to apply an attacker mindset when evaluating new technologies.
Experience evaluating applications or SaaS platforms from a security perspective, including permissions, architecture, integrations, authentication, authorization, data access, and administrative controls.
Working knowledge of modern identity and authentication technologies including SSO, SAML, OAuth 2.0, OpenID Connect, MFA, Microsoft Entra ID, enterprise application registrations, and Conditional Access.
Understanding of Windows and cloud security concepts, endpoint security controls, networking, APIs, and common enterprise application deployment models.
Experience working with security technologies such as vulnerability scanners, endpoint detection and response platforms, SIEM platforms, identity security tools, network security platforms, or application security testing tools.
Ability to research unfamiliar technologies, understand how they operate, identify meaningful security concerns, and distinguish theoretical risk from realistic enterprise risk.
Strong analytical and troubleshooting skills with attention to technical detail.
Ability to communicate security findings clearly and work collaboratively with technical teams, application owners, vendors, and business stakeholders.
A strong desire to continuously learn about emerging technologies, vulnerabilities, attack techniques, and changes in the cyber threat landscape.

Nice To Haves

Familiarity with tools such as Qualys, CrowdStrike Falcon, Microsoft Sentinel, Microsoft Entra ID, Burp Suite, or comparable security platforms is preferred.
Scripting, API, or automation experience with PowerShell, Python, or similar technologies is preferred.

Responsibilities

Perform technical security assessments of software applications, SaaS platforms, browser extensions, integrations, AI-enabled technologies, and other technologies proposed for use within the Firm.
Evaluate application architecture, permissions, data access, administrative controls, authentication methods, APIs, OAuth integrations, third-party dependencies, logging capabilities, and security configuration.
Assess how compromised or malicious applications could be leveraged as an attack vector, including credential theft, data exposure, persistence, privilege escalation, lateral movement, command and control, and software supply-chain compromise.
Review vendor and application security documentation, vulnerability information, threat intelligence, software dependencies, and publicly available security research to identify potential risks.
Evaluate authentication and authorization configurations including SSO, SAML, OAuth/OIDC, MFA, Microsoft Entra ID integrations, Conditional Access policies, service principals, application registrations, API permissions, and privileged access requirements.
Work with infrastructure, endpoint, cloud, identity, networking, and application teams to identify security design or configuration gaps and recommend practical remediation or compensating controls.
Review existing deployed applications to determine business need, usage, software versions, support status, known vulnerabilities, available updates, and potential security exposure.
Assist with application inventory and software lifecycle initiatives designed to identify unnecessary, obsolete, vulnerable, or unauthorized applications within the environment.
Validate approved application deployments to confirm that software, security controls, permissions, integrations, and configurations were implemented according to approved requirements.
Use vulnerability management, endpoint security, SIEM, identity, network, asset discovery, and other security telemetry to understand application behavior and identify potential security concerns.
Support Security Operations with threat hunting, security investigations, incident response, and other operational security activities as needed.
Clearly document findings, risk, technical impact, and recommended controls for both technical and non-technical audiences.
Exercise independent judgment, curiosity, and initiative when investigating unfamiliar technologies and security risks.