Cybersecurity Engineer Jobs

About The Position

Requirements

• Hands-on production experience with enterprise XDR/EDR, identity and access management, and endpoint management platforms.
• Experience with SIEM/XDR query languages such as KQL, SPL, or similar.
• Scripting or automation skills using PowerShell or Python, and comfort with APIs.
• Practical incident response experience and working knowledge of NIST SP 800-61 and MITRE ATT&CK.
• Technical leadership and mentoring experience.
• Bachelor’s degree in Computer Science, Information Security, Information Technology, or a related field, or equivalent work experience.
• At least 5 years in security engineering, security operations, or detection engineering.
• Strong problem-solving and analytical mindset.
• Ability to communicate complex technical and security concepts to non-technical stakeholders.
• Composure and sound judgment under pressure during high-severity incidents.
• Collaborative and proactive attitude with a focus on continuous improvement.
• Strong organizational skills and attention to detail.
• Availability for after-hours and weekend response during Priority 1–2 security incidents and scheduled maintenance windows.
• Reliable, secure internet connection for the home-office setting.

Nice To Haves

• Industry security certifications such as CompTIA CySA+, GIAC GCIH or GCIA, or vendor credentials including AWS Certified Security – Specialty, Cisco CCNP Security, CrowdStrike CCFR, Microsoft SC-200/SC-500, Palo Alto Networks PCNSE, Splunk Certified Cybersecurity Defense Analyst, or equivalent.
• Experience with data loss prevention (DLP), vulnerability management programs, or application security tooling.
• Familiarity with PCI DSS technical requirements and OT or ICS environments.

Responsibilities

• Administer, configure, and tune security platforms, including endpoint and cloud protection, SIEM and managed detection and response (MDR), vulnerability and attack surface management, application security, and email security.
• Maintain security tool health and coverage, including onboarding, agent and sensor deployment, tooling maintenance, licensing use, integrations, and gap reports against the asset inventory.
• Assist with technical vendor relationships, including the MDR provider, and keep escalation paths and playbooks current.
• Automate repetitive work to reduce analyst toil and configuration drift.
• Act as a lead incident responder during Priority 1–2 incidents.
• Support security analysts and the MDR provider’s SOC with tickets during volume surges; tune alerts and write response playbooks and automation for common alert types.
• Measure detection quality using ATT&CK technique coverage, false positive rate, and alert-to-incident ratio; run purple-team or atomic tests to validate rules.
• Turn post-incident findings into new detections within an agreed time after incident closure.
• Serve as technical lead for security roadmap initiatives involving areas such as data protection, identity and access hardening, network and IT/OT segmentation, cloud security posture, and controls for emerging technologies, including AI tools.
• Write designs, build and test changes, hand off operational runbooks, and follow the Change Management Plan.
• Support PCI DSS technical controls with evidence the GRC Analyst can assess independently.
• Perform other duties as assigned.