Security Engineer

Watsco•Coconut Grove, FL

13d

About The Position

Watsco Inc. is seeking a Security Engineer to operate and continuously improve cybersecurity monitoring, incident response, vulnerability management, email and endpoint security, cloud and identity controls, risk, and security assurance. The role partners with IT owners and an MDR provider to reduce risk while maintaining independent review of security controls. The position may require scheduled after-hours work, participation in incident response, and local travel. Duties may evolve with business needs. Reasonable accommodations will be provided in accordance with applicable requirements.

Requirements

4+ years of cybersecurity engineering, security operations, incident response, vulnerability management, or equivalent defensive-security experience.
Hands-on knowledge of SIEM, EDR, email security, identity and cloud security, vulnerability scanning, network security, Windows environments, and incident investigation.
Ability to analyze logs and alerts, communicate risk clearly, preserve evidence, write policies/runbooks, and coordinate technical remediation across owners and vendors.
Working knowledge of common security frameworks and controls, least privilege, segmentation, secure configuration, risk treatment, and audit evidence.
Ability to participate in after-hours incident response and handle sensitive information with discretion.

Nice To Haves

Experience with Microsoft Defender, Entra ID, Microsoft 365, Proofpoint, cloud security, MDR/SOC operations, scripting, and multi-site environments.
Relevant Security+, CySA+, GCIH, GCIA, CISSP, CCSP, Microsoft Security, or comparable certification.
Experience with NIST CSF, CIS Controls, ISO 27001, PCI DSS, privacy obligations, or customer assurance programs as applicable.

Responsibilities

Operate or oversee SIEM, EDR, email-security, identity, cloud, and MDR monitoring; investigate alerts, tune detections, validate logging coverage, and escalate material events.
Lead technical incident response, including triage, containment, evidence preservation, partner coordination, recovery support, post-incident review, and corrective-action tracking.
Run the vulnerability-management program: maintain scan coverage, risk-rank findings, assign remediation, manage time-bound exceptions, rescan, and report overdue exposure.
Administer Proofpoint security policy and investigate phishing; manage blocking, whitelisting, impersonation protection, SPF/DKIM/DMARC coordination, and security-related release escalations.
Define and validate MFA, SSPR, Conditional Access, privileged access, account recovery, access review, and compromised-account requirements in partnership with Infrastructure.
Define endpoint/server hardening, EDR, encryption, logging, and isolation requirements; validate remediation performed by Service Delivery and Infrastructure.
Review segmentation, firewall rules, remote access, cloud configurations, internet-facing services, new applications, architectures, and significant technology changes.
Maintain security policies, standards, risk register, exceptions, metrics, audit evidence, customer/security questionnaires, cyber-insurance support, and remediation plans.
Assess critical vendors, partner access, SaaS/cloud services, contractual security requirements, and third-party remediation.
Deliver role-based awareness, phishing exercises, incident runbooks, tabletops, and cross-training; coordinate MDR, forensic, penetration-testing, and specialist partners.