Security Operations Engineer

Auberge Collection•Bethesda, MD

5d•$120,000 - $140,000•Onsite

About The Position

Auberge Collection is seeking a Security Operations Engineer to operate and improve security tools and response practices across Home Office, cloud, and hotel environments. The role leads technical incident response, advances vulnerability remediation, oversees managed security provider performance, and supports security controls and audit readiness. Based in Bethesda, the role partners with Technology, Regional IT, property teams, and external providers. A managed security service provider (MSSP) provides contracted monitoring and coverage; this role owns Auberge’s internal technical escalation and response and does not require solo, continuous 24×7 monitoring. The Security Operations Engineer is responsible for the effectiveness and lifecycle of Auberge’s security tools, including SIEM, EDR, vulnerability management, identity, email, DLP, and cloud security platforms. The role improves monitoring, data visibility, alert accuracy, integrations, response playbooks, and control coverage; works with platform owners on secure configurations, access controls, privileged account management, and documentation; investigates and coordinates response to incidents; and manages vulnerability remediation. The role also coordinates MSSP delivery, provides an escalation path for Regional IT and properties, maintains hotel security scorecards, and supports PCI and privacy assessments. It reviews security needs for cloud, applications, integrations, major changes, and property openings. It builds security-focused scripts, integrations, and workflows for investigation and reporting, with appropriate safeguards and human review, and partners with Enterprise Data & AI and AI Engineering when shared AI services, governed data access, or production applications are involved.

Requirements

Five or more years in security operations, security engineering, incident response, or a related field.
Hands-on experience administering or improving SIEM, EDR, vulnerability, identity, cloud security, or similar platforms.
Experience investigating incidents, coordinating technical response, managing vulnerability remediation, and working with managed security providers.
Working knowledge of security controls, audit evidence, identity and access, least privilege, endpoint and cloud security, and data protection.
Practical scripting or automation experience with APIs, workflow tools, Python, PowerShell, JavaScript, or similar.
Clear risk communication, documentation, and collaboration skills across distributed technical and hotel operations teams.
Sound judgment in evaluating AI-generated information before consequential action.

Nice To Haves

Experience in hospitality, retail, or another multi-site environment.
Experience with security automation, SOAR, AI-enabled workflows, or agentic systems.
Familiarity with PCI DSS, privacy requirements, NIST Cybersecurity Framework, MITRE ATT&CK, or OWASP guidance for LLMs and agentic applications.
Experience with security dashboards, risk scorecards, or executive reporting.
CISSP, GCIH, GCIA, Security+, or equivalent practical experience.

Responsibilities

Operate and improve security tools across Home Office, cloud, and hotel environments, including SIEM, EDR, vulnerability management, identity, email, DLP, and cloud security.
Strengthen security monitoring by improving data visibility, alert accuracy, system integrations, response playbooks, and control coverage.
Partner with platform owners to maintain secure configurations and current access controls, oversee privileged account management, and keep architecture and integration documentation current.
Identify capability gaps and recommend practical improvements to the Director of Cybersecurity.
Investigate and lead technical response to phishing, malware, account compromise, unauthorized access, data exposure, and other incidents.
Coordinate incident containment, recovery, evidence, communications, and post-incident reviews with the Director, MSSP, Regional IT, property leaders, and affected teams.
Escalate high-severity incidents promptly and support the designated incident leader.
Prioritize vulnerabilities by risk, assign remediation, manage exceptions, validate fixes, and report progress.
Identify recurring incidents and control weaknesses and drive corrective actions with accountable owners.
Coordinate MSSP delivery, including alert quality, escalation paths, playbooks, service levels, and improvement plans; raise coverage gaps and unresolved risks.
Provide an escalation path for Regional IT and properties, coordinating response through established operating structures.
Maintain practical hotel security scorecards and review material risks and corrective actions with Technology and property leaders.
Support PCI and privacy assessments with technical evidence, control testing, and remediation of assigned findings.
Review security needs for cloud, applications, integrations, major changes, and property openings; maintain procedures and technical documentation.
Build security-focused scripts, integrations, and workflows for alert enrichment, investigation, phishing analysis, vulnerability prioritization, case documentation, and reporting.
Apply least privilege, secure credential handling, data minimization, audit logging, and human review; test accuracy, reliability, and operational value.
Keep consequential actions, including containment, access changes, and external communications, within approved authorization and escalation controls.
Partner with Enterprise Data & AI and AI Engineering when workflows require shared AI services, governed data access, or production applications.