Security Operations Engineer

CRB•Kansas City, CO

1d•Hybrid

About The Position

The Security Operations Engineer strengthens and advances the security, privacy, and operational resilience of CRB’s enterprise technology environment. The role protects infrastructure, endpoints, identities, SaaS platforms, cloud services, and business applications by combining cybersecurity, security engineering, IT operations, compliance, and offensive security expertise. It partners with IT, Legal, Compliance, Privacy, and business stakeholders to turn security and regulatory requirements into practical technical solutions, sustainable operational processes, and measurable outcomes. The position reports to the Director of Security Engineering. The role serves as CRB’s primary technical liaison to managed security services providers and supports security operations, risk management, audit readiness, identity and endpoint security, vulnerability remediation, incident response, and operational resilience. It also conducts authorized vulnerability assessments and penetration testing, supports privacy and compliance programs, evaluates vendors and technologies, and automates security and operational workflows. The position follows a hybrid schedule, with three days per week in the office, and can be based in Kansas City, Missouri; St. Louis, Missouri; Denver, Colorado; or Dallas, Texas.

Requirements

Bachelor’s degree in Information Security, Information Technology, Computer Science, Business Administration, or a related field, or equivalent experience.
At least 3 years of experience in cybersecurity, IT operations, infrastructure management, endpoint administration, enterprise applications, or a related discipline.
Experience supporting enterprise endpoints, SaaS platforms, identity systems, and geographically distributed workforces.
Experience with vulnerability management, penetration testing, incident response, network security analysis, and digital forensics.
Experience administering Microsoft 365, Azure Entra ID, Intune, or comparable identity and endpoint management solutions.
Working knowledge of SSO, SAML, MFA, privileged access management, access provisioning, and least-privilege principles.
Understanding of firewalls, intrusion detection and prevention systems, network security monitoring, operating system security, and common attack methodologies.
Experience automating technical processes using Python, PowerShell, or similar scripting languages.
Experience supporting audits, compliance reviews, technical documentation, evidence collection, and control testing.
Working knowledge of GDPR and familiarity with German and Swiss privacy regulations.
Strong analytical, problem-solving, organizational, and communication skills.
Ability to manage multiple priorities, work independently, and drive cross-functional remediation efforts.

Nice To Haves

Professional security certifications such as CompTIA Security+, Cloud+, OSCP, PNPT, GPEN, CEH, or comparable credentials.
Experience participating in penetration testing, red-team engagements, security labs, or adversary simulations.
Experience supporting business operations in Germany, Switzerland, Austria, or other European jurisdictions.
Experience with Microsoft Defender, SIEM platforms, EDR solutions, vulnerability scanning tools, and cloud security technologies.
Experience conducting third-party risk assessments and vendor security reviews.
Familiarity with ISO 27001, ISO 27701, ISO 42001, the NIST Cybersecurity Framework, or similar governance frameworks.
Experience with Jira Service Management, Jira Assets, Confluence, SharePoint, Power BI, or related enterprise platforms.

Responsibilities

Serve as CRB’s primary technical liaison to MSSPs, overseeing security operations activities, vulnerability assessments, remediation efforts, and third-party service delivery.
Maintain and administer the enterprise security and privacy risk register, ensuring risks are identified, assessed, tracked, mitigated, and reported through established governance processes.
Develop and maintain security policies, standards, procedures, control documentation, runbooks, user guidance, and incident response documentation.
Lead audit readiness and compliance activities, including evidence collection, control-effectiveness validation, assessment support, and maintenance of audit documentation.
Implement, administer, and improve security controls across cloud environments, SaaS platforms, and enterprise systems.
Own identity and access management processes, including Azure Entra ID, SSO, MFA, privileged access management, provisioning, and deprovisioning.
Support endpoint security, patch management, device compliance, configuration management, and asset lifecycle operations.
Maintain accurate inventories of technology assets, applications, user accounts, licenses, data flows, and system ownership.
Partner with IT teams and business stakeholders to improve secure configuration management, vulnerability remediation, backup and recovery, and operational resilience.
Evaluate technologies, vendors, integrations, and data management practices for alignment with security and privacy requirements.
Automate security and operational workflows using Python, PowerShell, Power Automate, Jira Automation, or comparable technologies.
Support security monitoring, incident investigation, containment, response, recovery, and continuous improvement.
Conduct authorized vulnerability assessments and penetration testing across infrastructure, networks, cloud environments, identity platforms, and enterprise applications.
Perform attack-path analysis and red-team exercises to identify security weaknesses, privilege escalation risks, and control gaps.
Analyze security events, threat intelligence, forensic evidence, and vulnerability findings to assess risk and business impact.
Document findings, assign risk ratings, identify root causes, recommend practical remediation strategies, and validate remediation through testing, evidence review, and control verification.
Support tabletop exercises, incident response simulations, and security control testing programs, ensuring testing is authorized, documented, and conducted in accordance with organizational policies and business requirements.
Support compliance with applicable privacy and security regulations, including GDPR, Germany’s BDSG, and Switzerland’s FADP.
Promote Secure by Design and Privacy by Design principles in technology initiatives and operational processes.
Support data governance activities, including records of processing, data flow mapping, retention controls, access reviews, and protection of sensitive information.
Partner with Legal, Privacy, Compliance, and business leaders on regulatory inquiries, vendor reviews, risk assessments, and remediation activities.
Translate regulatory, audit, contractual, and customer requirements into actionable technical and operational controls.
Assess third-party technology providers and document associated security and privacy risks.
Track security and compliance findings through closure and provide meaningful reporting to technical and business stakeholders.
Support CRB’s security, privacy, and governance frameworks, including ISO- and NIST-aligned initiatives.