THE SECURITY ENGINEER IS A HANDS-ON TECHNICAL ROLE RESPONSIBLE FOR DESIGNING,
IMPLEMENTING, OPERATING, AND CONTINUOUSLY IMPROVING SECURITY CONTROLS ACROSS
CLOUD, IDENTITY, ENDPOINT, EMAIL, NETWORK, DATA, AND HYBRID INFRASTRUCTURE. THE
ENGINEER CONVERTS SECURITY REQUIREMENTS AND THREAT SCENARIOS INTO DEPENDABLE
CONFIGURATIONS, DETECTIONS, AUTOMATIONS, INVESTIGATIONS, AND DOCUMENTED
OPERATING PROCEDURES.
THIS ROLE PARTNERS WITH INFRASTRUCTURE, NETWORK, CLOUD, IAM, MICROSOFT 365,
APPLICATION, SERVICE DESK, LEGAL, PRIVACY, AUDIT, AND THIRD-PARTY PROVIDERS.
SUCCESS REQUIRES DISCIPLINED OWNERSHIP, SOUND JUDGMENT, TECHNICAL CURIOSITY,
CLEAR COMMUNICATION, AND THE ABILITY TO MOVE WORK FROM INITIAL INTAKE THROUGH
VALIDATION, IMPLEMENTATION, EVIDENCE COLLECTION, AND CLOSURE.
PRIMARY OUTCOMES
IMPROVED VISIBILITY AND REDUCED DETECTION LATENCY FOR HIGH-IMPACT IDENTITY,
PRIVILEGE, ENDPOINT, EMAIL, CLOUD, AND NETWORK THREATS.
SECURE, SUPPORTABLE, AND WELL-DOCUMENTED CONFIGURATIONS FOR ENTERPRISE
SECURITY PLATFORMS AND INTEGRATIONS.
TIMELY, EVIDENCE-BASED INCIDENT TRIAGE, INVESTIGATION, CONTAINMENT
COORDINATION, ROOT-CAUSE ANALYSIS, AND FOLLOW-THROUGH.
CONSISTENT SECURITY REVIEW OF TECHNOLOGY CHANGES, FIREWALL REQUESTS, CLOUD
DEPLOYMENTS, IDENTITY CHANGES, AND PRODUCTION RELEASES.
AUTOMATION THAT REDUCES MANUAL EFFORT, IMPROVES DATA QUALITY, AND STRENGTHENS
REPEATABILITY WITHOUT COMPROMISING CONTROL OR AUDITABILITY.
CLEAR TECHNICAL OWNERSHIP, CURRENT DOCUMENTATION, DEFENSIBLE CHANGE RECORDS,
AND MEASURABLE OPERATIONAL HEALTH.
SECURITY ENGINEERING AND ARCHITECTURE
DESIGN, IMPLEMENT, MAINTAIN, AND IMPROVE SECURITY CONTROLS ALIGNED WITH ZERO
TRUST, LEAST PRIVILEGE, DEFENSE-IN-DEPTH, SECURE-BY-DEFAULT, AND RISK-BASED
DESIGN PRINCIPLES.
PROVIDE SECURITY DESIGN REVIEW AND TECHNICAL CONSULTATION FOR CLOUD, NETWORK,
IDENTITY, ENDPOINT, MESSAGING, DATA PROTECTION, APPLICATION, AND HYBRID
INFRASTRUCTURE INITIATIVES.
TRANSLATE BUSINESS, REGULATORY, AND ARCHITECTURAL REQUIREMENTS INTO PRACTICAL
SECURITY CONFIGURATIONS, STANDARDS, BASELINES, AND IMPLEMENTATION PLANS.
PARTICIPATE IN MAJOR TECHNOLOGY PROJECTS AND CHANGES EARLY ENOUGH TO IDENTIFY
SECURITY DEPENDENCIES, ROLLBACK NEEDS, LOGGING REQUIREMENTS, AND CONTROL GAPS
BEFORE PRODUCTION IMPLEMENTATION.
EVALUATE EMERGING TECHNOLOGIES AND RECOMMEND IMPROVEMENTS BASED ON BUSINESS
VALUE, OPERATIONAL SUPPORTABILITY, THREAT REDUCTION, INTEGRATION FIT, AND
TOTAL COST.
DETECTION ENGINEERING, SIEM AND SECURITY AUTOMATION
ENGINEER AND OPTIMIZE MICROSOFT SENTINEL DATA CONNECTORS, ANALYTICS RULES,
INCIDENT CREATION LOGIC, AUTOMATION RULES, WORKBOOKS, WATCHLISTS, AND LOGIC
APPS OR SOAR PLAYBOOKS.
DEVELOP AND MAINTAIN KQL QUERIES FOR ALERTING, THREAT HUNTING, OPERATIONAL
MONITORING, TROUBLESHOOTING, EVIDENCE COLLECTION, AND SECURITY REPORTING.
VALIDATE SOURCE TELEMETRY, CONNECTOR HEALTH, INGESTION GAPS, PARSING,
NORMALIZATION, RULE EXECUTION, ALERT GROUPING, DEDUPLICATION, AND ESCALATION
PATHS.
TUNE DETECTIONS USING DOCUMENTED THREAT SCENARIOS, SEVERITY, EXPECTED
DETECTION LATENCY, FALSE-POSITIVE ANALYSIS, QUERY PERFORMANCE, AND ANALYST
WORKLOAD.
AUTOMATE REPEATABLE SECURITY ADMINISTRATION AND RESPONSE ACTIVITIES WITH
POWERSHELL, KQL, APIS, AND APPROVED ORCHESTRATION CAPABILITIES WHILE
PRESERVING APPROVALS AND AUDIT TRAILS.
INCIDENT RESPONSE AND THREAT INVESTIGATION
TRIAGE AND INVESTIGATE ALERTS FROM MICROSOFT SENTINEL, MICROSOFT DEFENDER
XDR, CROWDSTRIKE FALCON, MIMECAST, PALO ALTO NETWORKS, IDENTITY PLATFORMS,
AND OTHER ENTERPRISE SOURCES.
CORRELATE IDENTITY, ENDPOINT, NETWORK, CLOUD, EMAIL, APPLICATION, AND
THREAT-INTELLIGENCE TELEMETRY TO DETERMINE SCOPE, IMPACT, CHRONOLOGY, AND
LIKELY ROOT CAUSE.
COORDINATE CONTAINMENT, ERADICATION, RECOVERY, EVIDENCE PRESERVATION, AND
ESCALATION WITH INTERNAL TEAMS, VENDORS, AND MANAGED SECURITY PARTNERS.
DOCUMENT INVESTIGATIVE STEPS, QUERIES, SCREENSHOTS, FINDINGS, DECISIONS,
AFFECTED ASSETS, COMMUNICATIONS, AND REMEDIATION ACTIONS IN THE DESIGNATED
INCIDENT RECORD.
LEAD OR SUPPORT HIGH-SEVERITY INCIDENTS AND AFTER-ACTION REVIEWS, INCLUDING
LESSONS LEARNED, DETECTION IMPROVEMENTS, PROCEDURE UPDATES, AND ASSIGNED
FOLLOW-UP ACTIONS.
PARTICIPATE IN AN ON-CALL OR AFTER-HOURS ROTATION AS REQUIRED FOR SIGNIFICANT
SECURITY EVENTS AND APPROVED PRODUCTION CHANGES.
SECURITY PLATFORM OPERATIONS
ADMINISTER AND IMPROVE CONTROLS ACROSS MICROSOFT SENTINEL, MICROSOFT DEFENDER
XDR, CROWDSTRIKE FALCON, MICROSOFT ENTRA ID, MICROSOFT PURVIEW, MIMECAST,
PALO ALTO NETWORKS FIREWALLS AND PANORAMA, AND RELATED SECURITY TECHNOLOGIES.
MONITOR PLATFORM HEALTH, INTEGRATION STATUS, LICENSING OR CAPACITY
CONSTRAINTS, PRIVILEGED ACCESS, CONFIGURATION DRIFT, POLICY EXCEPTIONS, AND
VENDOR ESCALATIONS.
REVIEW AND VALIDATE FIREWALL AND CONNECTIVITY REQUESTS, INCLUDING SOURCE,
DESTINATION, PORT, PROTOCOL, DIRECTION, BUSINESS PURPOSE, DATA SENSITIVITY,
SEGMENTATION, LOGGING, OWNERSHIP, AND ROLLBACK REQUIREMENTS.
SUPPORT IDENTITY SECURITY CAPABILITIES SUCH AS CONDITIONAL ACCESS, MFA,
IDENTITY PROTECTION, PRIVILEGED ACCESS, ACCESS GOVERNANCE, SERVICE-ACCOUNT
CONTROLS, AND INVESTIGATION OF ANOMALOUS AUTHENTICATION ACTIVITY.
PARTNER WITH PLATFORM OWNERS TO ADDRESS ENDPOINT COVERAGE, CLOUD POSTURE
FINDINGS, VULNERABILITY EXPOSURE, UNSUPPORTED SYSTEMS, AND TELEMETRY GAPS.
VULNERABILITY, CHANGE AND RISK MANAGEMENT
ANALYZE VULNERABILITY AND EXPOSURE DATA, VALIDATE TECHNICAL RISK, COORDINATE
REMEDIATION WITH SYSTEM OWNERS, AND TRACK MATERIAL FINDINGS THROUGH CLOSURE
OR APPROVED RISK ACCEPTANCE.
PROVIDE SECURITY SUBJECT-MATTER EXPERTISE FOR STANDARD, NORMAL, AND EMERGENCY
CHANGES; VERIFY TESTING, IMPLEMENTATION EVIDENCE, AND POST-CHANGE VALIDATION.
SUPPORT THIRD-PARTY SECURITY REVIEWS AND TECHNICAL DUE DILIGENCE BY
IDENTIFYING INTEGRATION RISKS, REQUIRED CONTROLS, LOGGING EXPECTATIONS,
ACCESS BOUNDARIES, AND REMEDIATION NEEDS.
ESCALATE MATERIAL CONTROL WEAKNESSES, UNSUPPORTED TECHNOLOGY, RECURRING
OPERATIONAL FAILURES, AND ACCEPTED RISKS THROUGH ESTABLISHED GOVERNANCE
CHANNELS.
DOCUMENTATION, AUDIT SUPPORT AND COLLABORATION
CREATE AND MAINTAIN SECURITY ARCHITECTURE RECORDS, STANDARDS, PROCEDURES,
RUNBOOKS, PLAYBOOKS, DIAGRAMS, CONFIGURATION BASELINES, CONTROL NARRATIVES,
AND KNOWLEDGE ARTICLES.
PRODUCE COMPLETE AND TIMELY SERVICENOW RECORDS, CHANGE DOCUMENTATION,
INVESTIGATION NOTES, EVIDENCE PACKAGES, AND STATUS UPDATES THAT CAN WITHSTAND
OPERATIONAL AND AUDIT REVIEW.
SUPPORT INTERNAL AND EXTERNAL ASSESSMENTS INVOLVING PCI DSS, SOX, NIST,
PRIVACY OBLIGATIONS, AND OTHER APPLICABLE REQUIREMENTS BY SUPPLYING ACCURATE
TECHNICAL EVIDENCE AND REMEDIATION UPDATES.
COMMUNICATE TECHNICAL FINDINGS AND RECOMMENDATIONS CLEARLY TO ENGINEERS,
SERVICE OWNERS, LEADERSHIP, AUDITORS, AND BUSINESS STAKEHOLDERS.
MENTOR DEVELOPING TEAM MEMBERS, SHARE INVESTIGATIVE METHODS, AND CONTRIBUTE
TO A UNIFIED OPERATING MODEL WITH CLEAR HANDOFFS, OWNERSHIP, AND
FOLLOW-THROUGH.
SKILLS
HANDS-ON EXPERIENCE WITH AN ENTERPRISE SIEM AND SECURITY ANALYTICS, INCLUDING
QUERY DEVELOPMENT, LOG-SOURCE ONBOARDING, DETECTION TUNING, ALERT
INVESTIGATION, AND OPERATIONAL HEALTH MONITORING.
PRACTICAL EXPERIENCE INVESTIGATING SECURITY EVENTS ACROSS TWO OR MORE DOMAINS
SUCH AS IDENTITY, ENDPOINT, EMAIL, NETWORK, CLOUD, APPLICATIONS, OR DATA.
WORKING KNOWLEDGE OF MICROSOFT CLOUD AND SECURITY TECHNOLOGIES, INCLUDING
MICROSOFT SENTINEL, DEFENDER XDR, ENTRA ID, AZURE, MICROSOFT 365, OR PURVIEW.
WORKING KNOWLEDGE OF ENTERPRISE NETWORK SECURITY CONCEPTS, INCLUDING
FIREWALLS, SEGMENTATION, VPNS, DNS, TLS, ROUTING, PORTS AND PROTOCOLS, PROXY
TECHNOLOGIES, AND TRAFFIC ANALYSIS.
ABILITY TO SCRIPT OR AUTOMATE TECHNICAL WORK USING POWERSHELL, KQL, PYTHON,
APIS, JSON, OR COMPARABLE TOOLS.
EXPERIENCE WITH INCIDENT, REQUEST, PROBLEM, AND CHANGE-MANAGEMENT PRACTICES,
INCLUDING ACCURATE TICKET DOCUMENTATION AND VALIDATION OF COMPLETED WORK.
UNDERSTANDING OF NIST SECURITY PRINCIPLES AND EXPERIENCE SUPPORTING REGULATED
OR AUDITED ENVIRONMENTS SUCH AS PCI DSS, SOX, PRIVACY, OR COMPARABLE CONTROL
FRAMEWORKS.
ABILITY TO COMMUNICATE RISK, INVESTIGATION FINDINGS, AND TECHNICAL
RECOMMENDATIONS TO BOTH TECHNICAL AND NON-TECHNICAL AUDIENCES.
QUALIFICATIONS
HANDS-ON EXPERIENCE WITH MICROSOFT SENTINEL, MICROSOFT DEFENDER XDR,
CROWDSTRIKE FALCON, PALO ALTO NETWORKS FIREWALLS OR PANORAMA, MIMECAST,
MICROSOFT ENTRA ID, MICROSOFT PURVIEW, AND SERVICENOW.
EXPERIENCE WITH AZURE SECURITY ENGINEERING, HYBRID IDENTITY, MICROSOFT 365
SECURITY, EMAIL SECURITY, CLOUD POSTURE MANAGEMENT, OR DATA PROTECTION
CAPABILITIES.
EXPERIENCE BUILDING SIEM OR SOAR CONTENT, CUSTOM PARSERS, AUTOMATION
PLAYBOOKS, THREAT-HUNTING QUERIES, OPERATIONAL DASHBOARDS, OR
DETECTION-AS-CODE PRACTICES.
EXPERIENCE WITH VULNERABILITY-MANAGEMENT PLATFORMS AND REMEDIATION WORKFLOWS
IN A LARGE OR COMPLEX ENTERPRISE.
EXPERIENCE IN RETAIL, ECOMMERCE, PAYMENT ENVIRONMENTS, CUSTOMER-DATA
PROTECTION, OR HIGH-AVAILABILITY DIGITAL SERVICES.
EDUCATION & EXPERIENCE REQUIREMENTS
BACHELOR’S DEGREE IN CYBERSECURITY, INFORMATION TECHNOLOGY, COMPUTER SCIENCE,
ENGINEERING, OR A RELATED FIELD, OR EQUIVALENT PRACTICAL EXPERIENCE.
AT LEAST 4 YEARS OF PROGRESSIVE EXPERIENCE IN SECURITY ENGINEERING, SECURITY
OPERATIONS, INCIDENT RESPONSE, CLOUD SECURITY, NETWORK SECURITY, OR A CLOSELY
RELATED TECHNICAL DISCIPLINE.
RELEVANT CERTIFICATIONS SUCH AS SC-200, AZ-500, SC-300, SC-400, PCNSE,
SECURITY+, GCIH, GCIA, CISSP, OR COMPARABLE TECHNICAL CREDENTIALS.