Sr. Security Engineer

Redwood Trust•Englewood, CO

20h

About The Position

The Sr. Security Engineer is responsible for cybersecurity design, implementation, and maintenance aligned with business initiatives. This senior technical resource and escalation point works across security operations, threat identification and remediation, and incident response, with hands-on responsibility for identity, endpoint, network, cloud, email, and data protection. The environment includes Azure, Microsoft 365, on-premises systems, and AI-driven products and services built on Azure AI Foundry and Microsoft Fabric. The role secures AI and machine learning workloads that handle borrower information and financial data while covering the broader security engineering function. The engineer partners with infrastructure engineering, application development, data, and database teams to embed security into systems and operations, and works with decision makers to identify, recommend, develop, implement, and support cost-effective security solutions. Redwood’s security program is being built out, giving this role influence over adopted standards and tooling. The position also supports regulatory and control obligations, provides security guidance to engineering teams, coordinates with outsourced security vendors, and participates in an after-hours incident-response on-call rotation.

Requirements

Bachelor’s degree in Computer Science, Information Security, Data Science, or a related field, or equivalent experience.
Six or more years in cybersecurity roles spanning security engineering, security operations, or application security.
Hands-on experience operating a SIEM, building detections, and working real incidents through resolution and lessons learned.
Experience with core cybersecurity tooling, including SIEM, endpoint protection, IAM, encryption, email security, and IDS or IPS.
Solid Azure cloud security foundations, including identity and access management, network controls, and native security tooling.
Experience securing AI or machine learning systems, including familiarity with prompt injection, data poisoning, model extraction, and data integrity attacks.
Understanding of cloud-based AI platforms such as Azure AI Foundry, Azure OpenAI, or Microsoft Copilot, and risks introduced by agent and retrieval-augmented-generation architectures.
Practical vulnerability management experience, including scanning, prioritization, and driving remediation across teams.
Scripting and automation ability in PowerShell, Python, or similar, and enough familiarity with CI/CD and infrastructure as code to build controls into pipelines.
Familiarity with NIST and CIS frameworks and awareness of emerging AI security guidance such as NIST AI RMF and the OWASP Top 10 for LLM applications.
Experience analyzing and documenting security solutions and mapping them to business requirements.
Ability to set and change priorities among multiple competing constituencies.
Ability to collaborate across technical and non-technical teams and explain complex security topics clearly.

Nice To Haves

Experience in financial services, mortgage, or another regulated industry.
Hands-on adversarial testing of LLM or agentic applications using tools such as PyRIT, Garak, or Promptfoo.
Penetration testing or red teaming background.
Detection engineering experience in Sentinel or a comparable SIEM, and experience building cybersecurity runbooks.
Knowledge of secure API design and authentication mechanisms.
Experience with Fortinet, SASE, or zero trust network access.
Experience with Microsoft Fabric or OneLake security and enterprise data platform protection.
Experience with a vendor risk management platform such as Whistic.
Certifications such as CISSP, CISM, CCSP, CompTIA Security+, CEH, or Azure security specialty credentials.

Responsibilities

Design, implement, and maintain security controls across identity, endpoint, network, cloud, email, and data protection, emphasizing Microsoft Entra ID, Defender, Sentinel, Purview, and Intune.
Analyze, evaluate, and document security risks across cloud, on-premises, and AI or machine learning applications, and recommend proportionate controls.
Operate and tune the SIEM, build and maintain detections, and investigate alerts through resolution.
Participate in incident response, coordinating investigation, containment, remediation, and post-incident analysis; respond urgently to incidents and vulnerabilities.
Conduct vulnerability scanning and testing, document findings, and drive remediation with infrastructure, application, and database teams.
Contribute to Identity and Access Management architecture and standards, including provisioning and deprovisioning, periodic access reviews, conditional access, and privileged access.
Embed security into delivery through pipeline controls, infrastructure-as-code guardrails, secrets management, and secure configuration baselines.
Secure AI and machine learning workloads, including model APIs, data pipelines, and copilot and agent deployments; monitor for prompt injection, data poisoning, and model extraction.
Perform third-party and vendor security assessments, review questionnaires, document risks, track remediation, and evaluate new services and AI features before adoption.
Integrate security monitoring across tools and platforms and use automation and AI to assist with SOAR, incident response, and monitoring.
Develop metrics, dashboards, and reporting for key security technologies, including Key Performance Indicators and Key Risk Indicators.
Contribute to security policies, standards, and runbooks aligned to the NIST Cybersecurity Framework and keep them current as the environment changes.
Support SOX IT general controls, GLBA safeguards, NYDFS Part 500, and SEC cyber disclosure readiness.
Provide engineering teams with training and guidance on secure development and secure AI practices.
Coordinate day-to-day with outsourced security vendors and the managed security service provider.
Participate in the after-hours on-call rotation for incident response.