Sr IT Security Engineer

Cornerstone Home Lending•,

2h•Onsite

About The Position

The Senior Security Engineer serves as a senior cybersecurity resource responsible for supporting and enhancing the organization's security program across security architecture, emerging technology and AI reviews, Identity and Access Management (IAM) governance, vulnerability management, and third-party security. Reporting directly to the Chief Information Security Officer (CISO), this role partners with technology and business stakeholders to identify, assess, mitigate, and validate cybersecurity risks and security controls while ensuring alignment with organizational security objectives and regulatory requirements. The role also supports security assurance, control effectiveness, remediation validation, security engineering, automation, and continuous improvement initiatives designed to strengthen the organization's overall security posture. Working closely with the Head of IAM and other security and technology leaders, the Senior Security Engineer provides oversight and verification of security controls, conducts security assessments, and supports cybersecurity risk management, compliance, and resilience efforts within a highly regulated banking environment. The ideal candidate brings strong technical expertise, sound risk-based judgment, a collaborative mindset, and the ability to translate cybersecurity requirements into practical and sustainable solutions. Experience within financial services is preferred, including familiarity with FFIEC guidance, NIST Cybersecurity Framework principles, and regulatory examination preparedness.

Requirements

Bachelor’s degree in information technology, Cybersecurity, Computer Science, or related field preferred.
Experience working within banking, financial services, mortgage lending, fintech, or other highly regulated industries.
Working knowledge of FFIEC guidance, banking regulatory expectations, and cybersecurity requirements applicable to financial institutions.
Familiarity with FDIC examinations, internal audits, external audits, and cybersecurity control assessments.
Strong understanding of the NIST Cybersecurity Framework (CSF), CIS Controls, and risk-based cybersecurity programs.
Familiarity with AI governance, AI risk management concepts, and the secure adoption of emerging technologies.
5+ years of experience in cybersecurity, information security, or security engineering.
Experience supporting Identity and Access Management programs, processes, and technologies.
Experience conducting security architecture reviews and technical risk assessments.
Experience managing or supporting enterprise vulnerability management programs.
Experience conducting vendor security reviews and third-party security assessments.
Experience with Microsoft Entra ID, Active Directory, Microsoft 365 security technologies, and cloud-based platforms.

Nice To Haves

CISSP
CISA
CompTIA Security+
ISC2 Certified in Cybersecurity (CC)
Microsoft SC-900 Security, Compliance, and Identity Fundamentals
Microsoft AZ-900 Azure Fundamentals
Microsoft SC-300 Identity and Access Administrator Associate
Additional cybersecurity, cloud security, or identity-focused certifications preferred.

Responsibilities

Assess security controls, identify risks and gaps, and support remediation and validation activities to promote effective and sustainable security practices.
Leverage security technologies, engineering practices, and automation to strengthen controls, improve efficiency, and reduce reliance on manual processes.
Support security metrics, reporting, and monitoring activities to provide visibility into security posture, control effectiveness, and emerging risks.
Participate in cybersecurity incident response, investigations, exercises, lessons learned, and initiatives that strengthen organizational resilience.
Contribute to the development and maintenance of security standards, procedures, and technical guidance aligned with business objectives, regulatory expectations, and industry practices.
Serve as a senior security advisor and collaborate with Technology, business, Risk, Compliance, Audit, and other stakeholders to identify and address cybersecurity risks.
Lead the enterprise phishing awareness program by conducting monthly phishing simulation campaigns, tracking and reporting key performance metrics, identifying user risk trends, and driving continuous improvement in employee cybersecurity awareness and resilience.
Serve as a trusted security advisor for enterprise technology initiatives, strategic projects, and business innovation efforts.
Conduct security architecture reviews for applications, infrastructure, cloud services, SaaS platforms, AI-enabled solutions, and third-party technologies.
Partner with architects, developers, engineers, project managers, and business stakeholders to identify, mitigate, and validate security requirements throughout solution design, implementation, and ongoing operation.
Review proposed solutions for secure authentication, authorization, encryption, data protection, logging, monitoring, resiliency, and recovery requirements.
Assess emerging technologies, including artificial intelligence (AI), generative AI, machine learning platforms, and AI-enabled business solutions, to ensure appropriate security controls, governance requirements, and data protection measures are established and maintained throughout the technology lifecycle.
Evaluate AI-related risks including unauthorized data exposure, excessive permissions, third-party AI integrations, sensitive data protection, model governance considerations, and regulatory compliance implications.
Provide guidance aligned with Zero Trust principles, secure-by-design methodologies, banking regulatory expectations, and industry best practices.
Participate in AI governance discussions and provide security recommendations for the adoption of emerging technologies.
Support the development, maintenance, and continuous improvement of security standards, architectural guidance, and technology control requirements.
Validate that key security requirements and controls are appropriately implemented and operating as intended.
Participate in vendor evaluations, technology assessments, and project planning activities to ensure security requirements are incorporated early in the project lifecycle.
Primarily support the organization's Identity and Access Management (IAM) program in partnership with the Head of IAM.
Provide second-line security oversight and independent verification of key cybersecurity controls, including IAM, privileged access, authentication, vulnerability management, and third-party security controls.
Administer and oversee identity lifecycle processes, including onboarding, transfers, role changes, and offboarding activities.
Support and verify role-based access controls (RBAC), privileged access controls, and segregation of duties requirements.
Support Privileged Access Management (PAM) solutions and privileged account governance activities.
Manage and support authentication technologies including Single Sign-On (SSO), Multi-Factor Authentication (MFA), Conditional Access, and identity federation.
Perform independent security control validation and testing to assess design effectiveness, implementation, and sustained operating effectiveness. Validate remediation activities end-to-end, including confirmation that changes have been implemented across affected systems, processes, and procedures.
Conduct periodic user access reviews and privileged access reviews.
Support Microsoft Entra ID, Active Directory, and related identity platforms.
Assist with audit requests, regulatory examinations, and control assessments related to identity and access management.
Support the tracking, validation, and closure of cybersecurity audit, assessment, and control findings, including validation that corrective actions address the underlying control deficiency and not solely the individual exception identified.
Develop and maintain cybersecurity metrics, key risk indicators (KRIs), and key performance indicators (KPIs) to measure control effectiveness, remediation progress, risk exposure, and security program maturity.
Prepare management-level reporting on cybersecurity risks, control effectiveness, remediation status, and emerging threats.
Identify opportunities to improve identity governance, automation, operational efficiency, and security effectiveness.
Lead enterprise vulnerability management activities, including identification, risk-based prioritization, remediation tracking, validation, and reporting across infrastructure, cloud, applications, and technology environments.
Establish and apply risk-based vulnerability prioritization using asset criticality, business impact, exploitability, threat intelligence, exposure, and the presence of compensating controls.
Partner with infrastructure, cloud, application, engineering, and technology teams to drive timely remediation of vulnerabilities and reduce organizational exposure.
Review and assess findings from vulnerability assessments, penetration tests, red team exercises, security assessments, and other technical security testing activities.
Monitor remediation performance, vulnerability aging, remediation SLAs, recurring findings, and risk trends; provide meaningful metrics and reporting to security leadership and governance committees.
Manage vulnerability-related exceptions, risk acceptances, and compensating controls, ensuring risks are appropriately documented, reviewed, and tracked through resolution.
Incorporate threat intelligence and emerging threat activity into vulnerability prioritization and remediation decisions, with heightened focus on actively exploited and internet-facing vulnerabilities.
Participate in third-party security reviews, vendor risk assessments, and ongoing security due diligence for prospective and existing vendors.
Evaluate the security posture, control environment, resilience, and risk management practices of third parties, with increased scrutiny for critical vendors, technology providers, and vendors that process sensitive or customer information.
Assess third-party security controls, technical safeguards, vulnerability management practices, incident response capabilities, data protection measures, and other cybersecurity risks.
Support ongoing third-party monitoring and reassessment throughout the vendor lifecycle, including onboarding, periodic reviews, significant changes, incidents, and offboarding.
Identify and assess third-party and technology supply-chain risks, including dependencies that may introduce material cybersecurity or operational risk.
Partner with Vendor Management, Procurement, Legal, Privacy, Compliance, and business stakeholders to ensure cybersecurity risks are incorporated into vendor selection, contracting, ongoing oversight, and risk decisions.
Support continuous improvement of vulnerability management and third-party risk management processes, including automation, workflow optimization, metrics, governance, and alignment with enterprise security objectives.