Senior Information Security Engineer

Berkley•Wilmington, DE

About The Position

Berkley Technology Services LLC provides technology solutions and services supporting the W. R. Berkley Corporation enterprise. The Senior Information Security Engineer leads engineering and ongoing enhancement of Microsoft Sentinel as the enterprise SIEM, builds security data ingestion pipelines and automation, implements Azure and cloud security controls, and works with cross-functional teams to strengthen the organization’s security posture. The role also supports Microsoft Purview data protection capabilities, establishes technical standards and operational guidance, monitors emerging threats, and translates business, regulatory, and security needs into technical controls. The engineer provides technical guidance to infrastructure, cloud, and application teams, presents project updates and recommendations to leadership, mentors junior engineers, and provides rotational Person in Charge (PIC) coverage as a senior escalation point for complex security incidents and operational decisions. The position is located in Wilmington, Delaware.

Requirements

At least 5 years of experience as a Cloud Security Engineer, Information Security Engineer, or DevSecOps Engineer.
At least 5 years of experience with network, cloud, and computer system security, including user access controls, role-based access control, SSO, file permissions, firewall policies, and audit logs.
At least 5 years of experience with security systems, including firewalls, intrusion detection systems, endpoint protection systems, web application firewalls, vulnerability scanning software, privileged access management, data loss protection, log management, and content filtering.
At least 5 years of experience developing and deploying security solutions to defend against advanced cyber threats.
At least 5 years of experience reviewing and monitoring security systems to ensure they are functioning properly and securely.
At least 5 years of experience investigating intrusion incidents and handling security incidents.

Responsibilities

Lead the engineering, deployment, administration, and continuous enhancement of Microsoft Sentinel, including workspace architecture, RBAC, retention management, and ingestion cost optimization.
Design, build, maintain, and troubleshoot security data ingestion pipelines and Sentinel connectors using Azure Monitor Agent, Data Collection Rules, CEF/Syslog, APIs, Event Hubs, Azure Functions, Logic Apps, and custom integrations.
Validate and troubleshoot ingested data using KQL and other tools, resolving data quality, schema, parsing, normalization, latency, performance, and reliability issues.
Engineer and support log routing, filtering, parsing, and transformation through Cribl; troubleshoot upstream ingestion issues and onboard new data sources into Sentinel.
Establish scalable patterns for onboarding security telemetry from on-premises, cloud, SaaS, and third-party platforms, including automated pipeline monitoring and validation.
Apply engineering best practices to Sentinel configurations and content, including source control, testing, peer review, CI/CD deployment, documentation, and lifecycle management.
Identify routine, repeatable, and manual security engineering tasks and develop automations to reduce operational effort, improve consistency, and accelerate response times.
Design, build, and maintain security automation and orchestration using Sentinel Automation Rules, Logic Apps, Azure Functions, PowerShell, Python, REST APIs, and Infrastructure as Code technologies such as Bicep, ARM, and Terraform.
Develop and maintain detection-as-code and automation-as-code practices, integrate security content deployment into CI/CD pipelines, and measure automation outcomes.
Design, implement, and maintain Azure security controls and architecture standards, including Microsoft Defender for Cloud, Azure Policy, Entra ID, Conditional Access, Key Vault, network security controls, and secure landing zones.
Translate business, regulatory, and security requirements into technical controls, monitoring requirements, and security baselines across Azure, hybrid, and on-premises environments.
Provide technical guidance and hands-on support to infrastructure, cloud, and application teams on secure architecture, cloud security best practices, and risk mitigation.
Design, implement, and maintain Microsoft Purview data protection capabilities, including DLP, sensitivity labels, information protection, Insider Risk Management, and auditing solutions.
Prepare and maintain technical standards, procedures, security documentation, runbooks, and operational guidance for Sentinel, cloud security, automation, and data protection.
Monitor emerging threats and industry trends and translate findings into detections, automation opportunities, and security control improvements.
Prepare and present project status, risks, and security initiatives to leadership, with actionable recommendations and clear explanations of technical concepts.
Lead and mentor junior security engineers through design reviews, technical guidance, knowledge sharing, and career development support.
Provide rotational PIC coverage as the senior escalation point for complex security incidents and operational decisions.
Collaborate with Security Operations, Infrastructure, Cloud, DevOps, and IT teams to improve enterprise security controls, monitoring, automation, and data protection.