Senior Cyber Security Engineer

Brown and Caldwell•Alexandria, VA

3d•$129,000 - $212,000•Hybrid

About The Position

The Senior Cyber Security Engineer protects the company's systems and information by designing, building, and supporting complex security solutions while driving the organization's compliance posture against applicable industry frameworks and client requirements. This role tackles ambiguous, high-impact security problems that lack predefined solutions and provides pragmatic, risk-based guidance for new technology initiatives with minimal oversight from the manager. Drawing on deep expertise across security tools, techniques, and processes, the Senior CSE monitors and responds to security alerts, manages incidents, and identifies and remediates vulnerabilities across the environment. The Senior CSE partners with technical teams and business stakeholders to focus on the highest priority risks while enabling the business to deliver client solutions securely. This position focuses on safeguarding valuable information through the establishment, enforcement, and managing of security standards. This role involves solving complex cyber security problems without predefined solutions that can significantly affect the company. The position also includes security guidance for new technology implementations with very limited oversight from the manager. This role uses cyber security expertise for alert evaluation, incident management, and vulnerability management.

Requirements

Strong comprehension and demonstratable skills in information and data security principles and practices.
Data-driven decision-making ability, with strong analytical and problem-solving skills.
Excellent communication skills to effectively provide relevant technical guidance to a broad set of stakeholders and mentor employees.
Proven skills in application security, software development security, authentication security, SEIM, automation, incident management, vulnerability management, compliance, and security solution implementation.
Strong Microsoft/Azure security skills, including automation.
Typically, a minimum of 8 years of relevant cyber security experience.
Experience with incident and vulnerability management and security guidance.
A relevant degree in computer science, cybersecurity, information systems, or related field or equivalent experience is required.

Nice To Haves

Relevant governance/compliance certifications (e.g., CISSP, CISA, CRISC, CGRC) preferred.
6+ years of direct cyber security experience, including hands-on compliance or audit-support work.
Working knowledge across many of the following domains, with deeper hands-on expertise in at least three or four: identity & access management; communications & network; asset; operations; software development; application; SIEM and detection engineering; automation/scripting; incident and vulnerability management; and assessment/compliance/audit support.
Working knowledge of AI-specific security considerations (e.g., securing AI/ML systems and evaluating AI-assisted tools for security use), and comfort using AI tools to improve security operations.
Relevant certifications (CISSP, Security+, etc).

Responsibilities

Monitor and respond to security alerts and tickets with professional acuity and precision.
Work with BC employees to provide support on complex issues, address security questions, and address concerns/threats.
Develop, implement, and enforce security standards and guidelines for the company.
Participate in the incident management process, working closely with other team members to respond and resolve security events and incidents.
Perform regular vulnerability and security assessments and recommend security solutions to mitigate potential risks.
Provide necessary security requirements and guidance for the company during new technology evaluations and implementations.
Coordinate and manage legal discovery and holds, as well as contract reviews and client security questionnaires.
Identify opportunities to improve processes and tasks via automation or efficiency.
Perform complex scripting and script debugging for automating security tasks.
Anticipate security challenges and implement preventative measures.
Ensure compliance with all relevant regulations and standards.
Make critical decisions balancing risks and opportunities to impact positively the company's overall security.
Flexibility to adapt and execute various additional assignments based on evolving need.
Design, build, and automate security solutions and tooling to detect, prevent, and manage threats across the environment.
Shape the security architecture of cloud and infrastructure environments.
Guide new technology initiatives with a security-first lens, providing pragmatic, risk-based recommendations that enable the business rather than block it.
Build and tune SIEM ingests, use cases, and alerting to sharpen detection capabilities.
Investigate and respond to alerts, incidents, and vulnerabilities, turning insight into action using established tools and playbooks.
Champion zero-trust and least-privilege access through regular access reviews.
Drive compliance and control maturity against applicable industry frameworks and contractual security requirements (e.g., SOC2, CMMC), including control implementation, audit preparation, and remediation tracking.
Assess risk across supplier and third-party relationships, and support Legal with eDiscovery and preservation requests as needed.
Partner closely with technical and business teams to deliver secure, high-quality capabilities, prioritizing the risks that matter most.
Keep a pulse on emerging threats and technologies and help shape how the team responds to them.
Provide mentorship, guidance, and knowledge-sharing to help less experienced team members develop their skills and grow within their roles.