Senior Security Engineer

Summary:

The Sr Security Engineer/Lead Cyber Incident Response Team (CIRT) Member will play a critical role in managing and coordinating responses to cybersecurity incidents. This position is responsible for overseeing the detection, analysis, and mitigation of security threats, ensuring timely and effective incident response, and leading the organization's efforts to protect its assets from cyberattacks. The Sr Security Engineer acts as a point of contact during security events, liaises with other IT and security departments, and ensures proper procedures are followed to minimize damage and prevent future incidents.

Principal duties and responsibilities:

Incident Detection and Analysis:

• Monitor security systems and event logs to detect potential security breaches.
• Perform detailed analysis of security incidents to determine their scope, root cause, and impact.
• Lead investigations into complex cybersecurity incidents, such as data breaches or advanced persistent threats (APTs).

Incident Response and Mitigation:

• Coordinate the immediate response to security incidents, including containment, eradication, and recovery activities.
• Lead incident response teams to quickly mitigate active threats and prevent further damage.
• Ensure the deployment of countermeasures and corrective actions to safeguard the organization.

Communication and Reporting:

• Act as the main point of contact during active incidents, communicating status updates to executives, IT teams, and relevant stakeholders.
• Prepare detailed incident reports, outlining actions taken and lessons learned.
• Provide briefings to senior management on incident findings, risks, and mitigations.

Team Leadership and Coordination:

• Lead a team of cybersecurity analysts, providing guidance, mentorship, and oversight on incident response practices.
• Collaborate with other IT and security departments to ensure a unified approach to incident handling and remediation.
• Organize regular incident response drills and tabletop exercises to test and improve the team's readiness.

Post-Incident Analysis and Documentation:

• Conduct post-incident reviews to evaluate the effectiveness of the response, identify any gaps, and recommend improvements.
• Update and maintain incident response plans and playbooks based on new threats and lessons learned from past incidents.

Proactive Threat Hunting and Vulnerability Management:

• Lead proactive threat hunting activities to identify weaknesses or potential attack vectors.
• Work closely with vulnerability management teams to ensure prompt remediation of security vulnerabilities.

Required Qualification

• Bachelor’s degree in computer science or related field plus 5 years related experience, OR Master’s degree plus 3 years related experience.
• Confirmed experience related to hands on technical focus across many areas of security engineering (Ex: Network Segmentation, firewalls, secure remote access, cloud security, IAM, PAM, EDR, DLP etc.)
• A proven track record in developing information security policies and procedures, and successful execution.
• Extensive knowledge of business risk, risk assessment and risk-based decision making.
• Able to communicate security and risk-related concepts to both technical and non-technical audiences (in business terms), including executive level.
• Ability to inspire and motivate cross-functional, interdisciplinary teams to achieve tactical and strategic goals; an innovative leader, problem solver and consultant.
• Ability to evangelize IT security to make it a critical part of business operations; build trust and respect for the security function.
• Management experience with demonstrated deliveries in developing a team.
• Excellent written and verbal communication, interpersonal and collaborative skills.
• Experienced with contract and vendor negotiations.
• Ability to effectively prioritize and execute tasks in high-pressure situations.
• Knowledge of security, risk and control frameworks and standards such as ISO 27001 and 27002, NIST 800-53, HITRUST and FedRAMP.
• Understanding of cloud, SaaS, and IoT architectures, and their implications on information security strategy.
• Technical acumen including but not limited to: Security Engineering, IT infrastructure, cloud, application development languages, tools and frameworks, database technologies, web technologies, next gen mobile, network architecture, enterprise architecture, and directory services.
• Security technology acumen and experience including but not limited to:
• firewall, intrusion detection, cyber-attack tools and defenses, encryption,
• certificate authority, web filtering, anti-malware, anti-phishing, identity and
• access management, multi factor authentication.

SKILLS RELATED TO POSITION:

• Cyber Security, AWS