Sr. Security Engineer

Redwood Trust Inc•Englewood, CO

1d•$150,000 - $175,000

About The Position

The Sr. Security Engineer is responsible for cybersecurity design, implementation, and maintenance aligned with business initiatives. This senior technical resource and escalation point works across security operations, threat identification and remediation, and incident response, with hands-on responsibility spanning identity, endpoint, network, cloud, email, and data protection. Redwood’s environment includes Azure, Microsoft 365, an on-premises footprint, and increasingly AI-driven products and services built on Azure AI Foundry and Microsoft Fabric. The engineer secures these environments, including AI and machine learning workloads that handle borrower information and material financial data. The role works closely with infrastructure engineering, application development, data, and database teams to embed security into systems and operations, and with decision makers to identify, recommend, develop, implement, and support cost-effective security solutions. The security program is being built out, giving this role influence over adopted standards and tooling. The role also supports regulatory and control obligations, security policies and standards, engineering guidance, vendor coordination, and an after-hours incident-response on-call rotation.

Requirements

Bachelor’s degree in Computer Science, Information Security, Data Science, or a related field, or equivalent experience.
Six or more years in cybersecurity roles spanning security engineering, security operations, or application security.
Hands-on experience operating a SIEM, building detections, and working real incidents through resolution and lessons learned.
Experience with core cybersecurity tooling, including SIEM, endpoint protection, IAM, encryption, email security, and IDS or IPS.
Solid Azure cloud security foundations, including identity and access management, network controls, and native security tooling.
Experience securing AI or machine learning systems, including familiarity with adversarial concepts such as prompt injection, data poisoning, model extraction, and data integrity attacks.
Understanding of cloud-based AI platforms such as Azure AI Foundry, Azure OpenAI, or Microsoft Copilot, and risks introduced by agent and retrieval-augmented generation architectures.
Practical vulnerability management experience, including scanning, prioritization, and driving remediation across teams.
Scripting and automation ability in PowerShell, Python, or similar, with enough familiarity with CI/CD and infrastructure as code to build controls into pipelines.
Familiarity with NIST and CIS frameworks, and awareness of emerging AI security guidance such as NIST AI RMF and the OWASP Top 10 for LLM applications.
Experience analyzing and documenting security solutions and mapping them to business requirements.
Ability to set and change priorities among multiple competing constituencies.
Ability to collaborate across technical and non-technical teams and explain complex security topics clearly.

Nice To Haves

Experience in financial services, mortgage, or another regulated industry.
Hands-on adversarial testing of LLM or agentic applications, including tools such as PyRIT, Garak, or Promptfoo.
Penetration testing or red teaming background.
Detection engineering experience in Sentinel or a comparable SIEM, and experience building cybersecurity runbooks.
Knowledge of secure API design and authentication mechanisms.
Experience with Fortinet, SASE, or zero trust network access.
Experience with Microsoft Fabric or OneLake security and enterprise data platform protection.
Experience with a vendor risk management platform such as Whistic.
Certifications such as CISSP, CISM, CCSP, CompTIA Security+, CEH, or Azure security specialty credentials.

Responsibilities

Design, implement, and maintain security controls across identity, endpoint, network, cloud, email, and data protection, with emphasis on Microsoft Entra ID, Defender, Sentinel, Purview, and Intune.
Analyze, evaluate, and document security risks across cloud, on-premises, and AI or machine learning applications, and recommend proportionate controls.
Operate and tune the SIEM, build and maintain detections, and work alerts through to resolution.
Participate in incident response, coordinating investigation, containment, remediation, and post-incident analysis; respond urgently to incidents and vulnerabilities.
Conduct vulnerability scanning and testing, document findings, and drive remediation with infrastructure, application, and database teams.
Contribute to Identity and Access Management architecture and standards, including provisioning and deprovisioning, periodic access reviews, conditional access, and privileged access.
Embed security into delivery through pipeline controls, infrastructure-as-code guardrails, secrets management, and secure configuration baselines.
Secure AI and machine learning workloads, including model APIs, data pipelines, and copilot and agent deployments; monitor for threats such as prompt injection, data poisoning, and model extraction.
Perform third-party and vendor security assessments, including questionnaire review, risk findings, and remediation tracking; evaluate new services and AI features before adoption.
Integrate security monitoring across tools and platforms, and use automation and AI to assist with SOAR, incident response, and monitoring.
Develop metrics, dashboards, and reporting for key security technologies, including Key Performance Indicators and Key Risk Indicators.
Contribute to security policies, standards, and runbooks aligned to the NIST Cybersecurity Framework, and keep them current as the environment changes.
Support control and regulatory obligations, including SOX IT general controls, GLBA safeguards, NYDFS Part 500, and SEC cyber disclosure readiness.
Provide engineering teams with training and guidance on secure development and secure AI practices.
Support day-to-day coordination with outsourced security vendors and the managed security service provider.
Participate in the after-hours on-call rotation for incident response.