Sr. IT Security Engineer

Follett Corporation•Westchester, IL

About The Position

Follett Higher Education is an educational service provider and omnichannel retailer supporting students, faculty, staff, parents, and fans with course materials, learning tools, and retail services. It supports over 6 million students through 1,100 physical and 1,750 eCommerce campus stores across North America. The Senior IT Security Engineer designs, implements, and maintains protective and detective controls to safeguard the confidentiality, integrity, and availability of Follett data and to support compliance with applicable regulatory standards, laws, contractual requirements, and best practices. The role plans, designs, implements, enforces, and audits security controls, policies, and procedures; monitors security trends and threats; and recommends tools, technologies, and process improvements to manage risk. The position manages, configures, and oversees technical security systems, including CrowdStrike, Microsoft Sentinel, Mimecast, Qualys, Illumio, and GlobalProtect. It also engineers identity management solutions such as privileged access management, multifactor authentication, and password vaulting. A key focus is supporting PCI DSS compliance across network security tools and practices, along with alignment to NIST CSF and NIST 800-53. The engineer monitors Follett’s security profile and collaborates with internal teams and Managed Security Service Providers (MSSPs) to support security operations.

Requirements

5–7 years of experience in information security, including at least 5 years in security engineering, network security, firewall administration, or compliance.
Strong experience with enterprise security platforms, including CrowdStrike, Qualys, Microsoft Sentinel, or comparable technologies.
Knowledge of network security architecture, firewall management, network segmentation, secure connectivity, and Zero Trust security models.
Experience securing cloud environments such as Microsoft Azure, AWS, or Google Cloud Platform (GCP).
In-depth understanding of PCI DSS compliance requirements, security audits, and remediation processes.
Familiarity with NIST CSF and NIST 800-53 security frameworks.
Experience with identity and access management (IAM), privileged access controls, multifactor authentication, and role-based access management.
Demonstrated ability to conduct security risk assessments, vulnerability management, and technical security troubleshooting.
Experience collaborating with third-party security providers and supporting regulatory compliance initiatives.

Responsibilities

Design, implement, and maintain enterprise security controls that protect company data, systems, and IT infrastructure.
Manage and administer security technologies, including CrowdStrike, Microsoft Sentinel, Mimecast, Qualys, Illumio, and GlobalProtect.
Support compliance with PCI DSS, the NIST Cybersecurity Framework (CSF), and NIST 800-53.
Conduct security assessments, vulnerability analyses, compliance audits, and risk evaluations to identify and address security gaps.
Engineer and maintain identity and access management solutions, including privileged access management, multifactor authentication, and password vaulting.
Implement and maintain network security measures, including firewalls, network segmentation, secure connectivity, and Zero Trust principles.
Support cloud security operations, including Azure native security controls and cloud security best practices.
Monitor security environments, investigate potential threats, troubleshoot technical issues, and recommend remediation strategies.
Develop and maintain security policies, procedures, and technical controls aligned with organizational and regulatory requirements.
Prepare security reports, communicate risks, and recommend improvements to strengthen the organization’s security posture.
Collaborate with internal IT teams, business stakeholders, and Managed Security Service Providers to support security operations.
Monitor information-security trends and threats, and recommend additional tools, technologies, controls, policies, and procedures as needed.
Evaluate and recommend security products, services, and procedures to enhance productivity and effectiveness.