Cyber Security Engineer

Key Responsibilities

• Design, deploy, and harden security controls across networks, endpoints, servers, identity, and cloud environments.
• Build threat-informed defenses using MITRE ATT&CK, threat intelligence, and lessons from real incidents.
• Engineer detections and response playbooks in SIEM, EDR/XDR, and SOAR platforms (e.g., Splunk, Sentinel, CrowdStrike, SentinelOne, Palo Alto Cortex), and test them against real attack techniques.
• Participate in purple team and adversary emulation exercises (Atomic Red Team, Caldera, Cobalt Strike, or similar), and remediate exposed gaps.
• Lead technical incident response, including triage, containment, forensics, root-cause analysis, and recovery.
• Manage vulnerability management and attack surface reduction: scanning, risk-based prioritization, patch strategy, and configuration baselines (e.g., CIS, DISA STIG).
• Secure network and perimeter infrastructure: firewalls, segmentation, IDS/IPS, VPN, ZTNA, and DNS and email security.
• Protect identity: MFA, privileged access, Active Directory and Entra ID hardening, and detection of credential abuse.
• Support cloud and container security with posture management, IaC scanning, and runtime protection.
• Automate repetitive tasks using Python, PowerShell, or Bash, and leverage AI-assisted tools for faster triage and analysis.
• Perform security reviews and threat modeling for new systems and changes.
• Support compliance and audits (e.g., NIST 800-53, NIST CSF, ISO 27001, SOC 2, CMMC, HIPAA, PCI-DSS) with clear evidence and automation.
• Document findings, write reports, and brief engineers and executives.
• Mentor teammates and share knowledge through internal talks and write-ups.

About the Role

• Cyber Security Engineer I (0-2 years): Scoped hardening and tooling tasks, detection tuning, vulnerability remediation tracking, incident support, learning with a mentor.
• Cyber Security Engineer II (2-5 years): Owning a security domain (endpoint, network, detection, or vulnerability management), leading projects and incident response, running purple team exercises, mentoring.
• Senior Cyber Security Engineer (5+ years): Architecting defensive capabilities, leading major incidents and cross-team initiatives, setting standards, shaping the roadmap, mentoring across the team.

Requirements & Tech Stack

• Solid foundations in networking (TCP/IP, DNS, TLS), Windows and Linux operating systems, and common attack techniques.
• Hands-on experience in at least one area: detection and response, endpoint security, network security, vulnerability management, or incident response.
• Understanding of frameworks such as MITRE ATT&CK, the NIST Cybersecurity Framework, and the Cyber Kill Chain.
• Scripting ability in Python, PowerShell, or Bash.
• A methodical, curious approach to investigation, and calmness under pressure during incidents.
• Clear written and verbal communication, especially in reports and incident briefings.
• Authorization to work in the US.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, IT, or a related field, or equivalent hands-on experience (home labs, CTFs, military training, and self-taught skills are valued).
• Certifications (Nice to have): Security+, CySA+, GCIH, GCIA, GCFA, GPEN, OSCP, CEH, CISSP, or cloud security certs (e.g., AWS Security Specialty, AZ-500).
• Experience (Nice to have):
• SIEM, EDR, SOAR, and threat intelligence platforms.
• Digital forensics, malware analysis, or threat hunting.
• Active Directory attack paths and defenses.
• Penetration testing, red teaming, or adversary emulation.
• Cloud, container, and Kubernetes security.
• Securing AI/LLM systems, including prompt injection and data leakage risks.
• Other (Nice to have): CTF results, bug bounty finds, CVEs, conference talks, or a home lab; Industry background in financial services, healthcare, SaaS, energy, manufacturing, government contracting, etc.; Active security clearance.