Note: The job is a remote job and is open to candidates in USA. Cornerstone Capital Bank is a financial services company operating community and business banking, mortgage, servicing, and insurance platforms. The Senior Security Engineer supports and enhances the cybersecurity program through security architecture, AI and emerging technology reviews, IAM governance, vulnerability management, third-party security, control validation, automation, incident response, and risk management in a regulated banking environment.
Responsibilities
- Security Assurance & Risk Management – Assess security controls, identify risks and gaps, and support remediation and validation activities to promote effective and sustainable security practices
- Security Engineering & Automation – Leverage security technologies, engineering practices, and automation to strengthen controls, improve efficiency, and reduce reliance on manual processes
- Security Monitoring & Reporting – Support security metrics, reporting, and monitoring activities to provide visibility into security posture, control effectiveness, and emerging risks
- Incident Response & Resilience – Participate in cybersecurity incident response, investigations, exercises, lessons learned, and initiatives that strengthen organizational resilience
- Security Governance & Standards – Contribute to the development and maintenance of security standards, procedures, and technical guidance aligned with business objectives, regulatory expectations, and industry practices
- Cross-Functional Partnership – Serve as a senior security advisor and collaborate with Technology, business, Risk, Compliance, Audit, and other stakeholders to identify and address cybersecurity risks
- Phishing - Lead the enterprise phishing awareness program by conducting monthly phishing simulation campaigns, tracking and reporting key performance metrics, identifying user risk trends, and driving continuous improvement in employee cybersecurity awareness and resilience
- Serve as a trusted security advisor for enterprise technology initiatives, strategic projects, and business innovation efforts
- Conduct security architecture reviews for applications, infrastructure, cloud services, SaaS platforms, AI-enabled solutions, and third-party technologies
- Partner with architects, developers, engineers, project managers, and business stakeholders to identify, mitigate, and validate security requirements throughout solution design, implementation, and ongoing operation
- Review proposed solutions for secure authentication, authorization, encryption, data protection, logging, monitoring, resiliency, and recovery requirements
- Assess emerging technologies, including artificial intelligence (AI), generative AI, machine learning platforms, and AI-enabled business solutions, to ensure appropriate security controls, governance requirements, and data protection measures are established and maintained throughout the technology lifecycle
- Evaluate AI-related risks including unauthorized data exposure, excessive permissions, third-party AI integrations, sensitive data protection, model governance considerations, and regulatory compliance implications
- Provide guidance aligned with Zero Trust principles, secure-by-design methodologies, banking regulatory expectations, and industry best practices
- Participate in AI governance discussions and provide security recommendations for the adoption of emerging technologies
- Support the development, maintenance, and continuous improvement of security standards, architectural guidance, and technology control requirements
- Validate that key security requirements and controls are appropriately implemented and operating as intended
- Participate in vendor evaluations, technology assessments, and project planning activities to ensure security requirements are incorporated early in the project lifecycle
- Primarily support the organization's Identity and Access Management (IAM) program in partnership with the Head of IAM
- Provide second-line security oversight and independent verification of key cybersecurity controls, including IAM, privileged access, authentication, vulnerability management, and third-party security controls
- Administer and oversee identity lifecycle processes, including onboarding, transfers, role changes, and offboarding activities
- Support and verify role-based access controls (RBAC), privileged access controls, and segregation of duties requirements
- Support Privileged Access Management (PAM) solutions and privileged account governance activities
- Manage and support authentication technologies including Single Sign-On (SSO), Multi-Factor Authentication (MFA), Conditional Access, and identity federation
- Perform independent security control validation and testing to assess design effectiveness, implementation, and sustained operating effectiveness. Validate remediation activities end-to-end, including confirmation that changes have been implemented across affected systems, processes, and procedures
- Conduct periodic user access reviews and privileged access reviews
- Support Microsoft Entra ID, Active Directory, and related identity platforms
- Assist with audit requests, regulatory examinations, and control assessments related to identity and access management
- Support the tracking, validation, and closure of cybersecurity audit, assessment, and control findings, including validation that corrective actions address the underlying control deficiency and not solely the individual exception identified
- Develop and maintain cybersecurity metrics, key risk indicators (KRIs), and key performance indicators (KPIs) to measure control effectiveness, remediation progress, risk exposure, and security program maturity
- Prepare management-level reporting on cybersecurity risks, control effectiveness, remediation status, and emerging threats
- Identify opportunities to improve identity governance, automation, operational efficiency, and security effectiveness
- Lead enterprise vulnerability management activities, including identification, risk-based prioritization, remediation tracking, validation, and reporting across infrastructure, cloud, applications, and technology environments
- Establish and apply risk-based vulnerability prioritization using asset criticality, business impact, exploitability, threat intelligence, exposure, and the presence of compensating controls
- Partner with infrastructure, cloud, application, engineering, and technology teams to drive timely remediation of vulnerabilities and reduce organizational exposure
- Review and assess findings from vulnerability assessments, penetration tests, red team exercises, security assessments, and other technical security testing activities
- Monitor remediation performance, vulnerability aging, remediation SLAs, recurring findings, and risk trends; provide meaningful metrics and reporting to security leadership and governance committees
- Manage vulnerability-related exceptions, risk acceptances, and compensating controls, ensuring risks are appropriately documented, reviewed, and tracked through resolution
- Incorporate threat intelligence and emerging threat activity into vulnerability prioritization and remediation decisions, with heightened focus on actively exploited and internet-facing vulnerabilities
- Participate in third-party security reviews, vendor risk assessments, and ongoing security due diligence for prospective and existing vendors
- Evaluate the security posture, control environment, resilience, and risk management practices of third parties, with increased scrutiny for critical vendors, technology providers, and vendors that process sensitive or customer information
- Assess third-party security controls, technical safeguards, vulnerability management practices, incident response capabilities, data protection measures, and other cybersecurity risks
- Support ongoing third-party monitoring and reassessment throughout the vendor lifecycle, including onboarding, periodic reviews, significant changes, incidents, and offboarding
- Identify and assess third-party and technology supply-chain risks, including dependencies that may introduce material cybersecurity or operational risk
- Partner with Vendor Management, Procurement, Legal, Privacy, Compliance, and business stakeholders to ensure cybersecurity risks are incorporated into vendor selection, contracting, ongoing oversight, and risk decisions
- Support continuous improvement of vulnerability management and third-party risk management processes, including automation, workflow optimization, metrics, governance, and alignment with enterprise security objectives
Skills
- Experience working within banking, financial services, mortgage lending, fintech, or other highly regulated industries
- Working knowledge of FFIEC guidance, banking regulatory expectations, and cybersecurity requirements applicable to financial institutions
- Familiarity with FDIC examinations, internal audits, external audits, and cybersecurity control assessments
- Strong understanding of the NIST Cybersecurity Framework (CSF), CIS Controls, and risk-based cybersecurity programs
- Familiarity with AI governance, AI risk management concepts, and the secure adoption of emerging technologies
- 5+ years of experience in cybersecurity, information security, or security engineering
- Experience supporting Identity and Access Management programs, processes, and technologies
- Experience conducting security architecture reviews and technical risk assessments
- Experience managing or supporting enterprise vulnerability management programs
- Experience conducting vendor security reviews and third-party security assessments
- Experience with Microsoft Entra ID, Active Directory, Microsoft 365 security technologies, and cloud-based platforms
- Occasional evening and weekend work to meet deadlines
- Sitting for extended periods of time
- Dexterity of hands and fingers to operate a computer keyboard, mouse, and to handle other computer components
- Ability to participate in training sessions, presentations, and meetings
- Ability to lift 30-40 lbs. This job will require picking up and moving equipment
- Ability to travel to other locations as needed
- Bachelor's degree in information technology, Cybersecurity, Computer Science, or related field preferred
- CISSP
- CISA
- CompTIA Security+
- ISC2 Certified in Cybersecurity (CC)
- Microsoft SC-900 Security, Compliance, and Identity Fundamentals
- Microsoft AZ-900 Azure Fundamentals
- Microsoft SC-300 Identity and Access Administrator Associate
- Additional cybersecurity, cloud security, or identity-focused certifications preferred
Benefits
- Remote work arrangement
Company Overview