Staff Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, develop, deploy, and manage security controls and tools across AWS, Azure, corporate networks, and endpoints.

• Engineer, adjust, and maintain SIEM content – including log onboarding, parsing, correlation rules, and detections – while creating automation and orchestration (SOAR) playbooks to enhance response times.

• Administer and optimize the endpoint detection and response (EDR) platform, covering sensor deployment, policy tuning, threat hunting assistance, and endpoint hardening.

• Engineer and sustain identity and access management features, including single sign-on (SSO), multi-factor authentication (MFA), conditional access, privileged identity/access management (PIM/PAM), and role lifecycle automation.

• Collaborate with Security Architecture to convert reference architectures and design principles into executed, measurable technical controls, offering insights that enhance future designs.

• Act as a technical leader during security incidents – developing and maintaining containment tools, forensics readiness, and response runbooks, while participating in post-incident evaluations.

• Manage the vulnerability management lifecycle: scanning, risk-based prioritization, and collaborating with application and infrastructure teams to ensure remediation is completed.

• Implement and uphold baseline security configuration standards (e.g., CIS benchmarks, OS hardening, network segmentation, web application firewall) using infrastructure-as-code and policy-as-code wherever feasible.

• Assess, conduct proof-of-concept, and recommend security technologies, tools, and services to the broader security team based on security policies, threat drivers, and operational compatibility.

• Mentor junior engineers, uphold high-quality documentation and runbooks, and engage in an on-call rotation for security escalations.

⛳️ Requirements

• At least seven (7) years of hands-on experience in security engineering and/or security operations.

• A minimum of three (3) years of experience engineering and managing security controls within Amazon Web Services (AWS) and Microsoft (MS) Azure.

• Bachelor’s degree in Computer Science, Information Systems, or equivalent practical experience.

• CISSP, CCSP, GIAC (e.g., GSEC, GCIH, GCIA), or other relevant security-related certifications.

• AWS Security Specialty Certification and Azure Security Engineer Certification.

• Experience in engineering identity platforms such as Microsoft Entra ID, including conditional access, privileged identity management (PIM), and identity governance.

• Experience with administering endpoint detection and response (EDR) platforms (e.g., CrowdStrike Falcon) and engineering SIEM detections, including detection-as-code practices.

• Proficiency in scripting and automation – using Python, PowerShell, and infrastructure-as-code tools such as Terraform – to deliver security capabilities at scale.

• Experience in DevSecOps, securing container and Kubernetes environments, CI/CD pipeline security, and safeguarding SaaS, IaaS, and PaaS workloads.

• Familiarity with network security technologies, including WAF/CDN/DDoS services, intrusion detection/prevention systems (IDS/IPS), network segmentation, and zero trust access models.

• Working knowledge of security frameworks and standards such as the NIST Cybersecurity Framework, HITRUST, CIS benchmarks, and the MITRE ATT&CK framework.

• Experience with data protection techniques, including data loss prevention (DLP), cryptography, key management, and public key infrastructure (PKI).

• Experience managing security tools in healthcare or other regulated environments subject to HIPAA or similar data protection requirements.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health, dental, and vision insurance.

• Retirement savings plan with employer matching.

• Opportunities for professional development and certifications.

• Flexible working hours and remote work options.