Principal Security Engineer job description

Cybersecurity — Principal Security Engineer
Sets security architecture and strategy across the organization.

RESPONSIBILITIES
- Set the detection engineering strategy for the organization, deciding where investment in content beats investment in tooling, and defend detection coverage decisions to leadership.
- Set intelligence requirements and sourcing strategy for the organization, and advise leadership on emerging threats before they become incidents.
- Set the offensive testing program for the organization, deciding what gets tested, how often and by whom, and interpret results against the real risk appetite of the organization.
- Set the cloud security baseline and guardrails for the organization, and decide which controls are enforced automatically versus left to review.
- Set the reference architectures and cryptographic standards teams build on, and plan for replacing an algorithm without redesigning systems.
- Decide how and when the organization threat models, and show that the practice changes what gets built.

REQUIREMENTS
- Experience at the Senior Security Engineer level (level 4 of 5) or equivalent
- Holds CompTIA Security+, GIAC Certified Incident Handler (GCIH), OffSec Certified Professional (OSCP), Certified Cloud Security Professional (CCSP) and Certified Information Systems Security Professional (CISSP)

REQUIRED SKILLS
Threat Operations
- Security Alert Triage — You can tune triage criteria and playbooks from what past alerts revealed, cutting noise without hiding a real signal, and review contested calls made by other analysts.
- Threat Detection Engineering — You can set the detection engineering strategy for the organization, deciding where investment in content beats investment in tooling, and defend detection coverage decisions to leadership.
- SIEM Monitoring and Tuning — You can plan SIEM capacity and log source coverage against real detection needs, and lead a platform migration without a monitoring gap.
- Incident Response Coordination — You can set the incident response program for the organization, including who has authority to declare and close an incident, and represent the organization to regulators or the board after a serious breach.
- Digital Forensics and Evidence Handling — You can lead forensic investigation of a complex intrusion spanning cloud and on-premises systems, and present findings that survive challenge from legal or a regulator.
- Threat Intelligence Analysis — You can set intelligence requirements and sourcing strategy for the organization, and advise leadership on emerging threats before they become incidents.

Exposure Management
- Vulnerability Scanning and Triage — You can validate whether a critical finding is actually exploitable in this environment before it triggers an emergency response, and improve the scanning program from what was missed.
- Vulnerability Remediation Coordination — You can run remediation across a portfolio of systems with competing priorities, and report exposure trends in terms leadership will act on.
- Penetration Testing and Exploitation — You can set the offensive testing program for the organization, deciding what gets tested, how often and by whom, and interpret results against the real risk appetite of the organization.
- Cloud Security Posture Management — You can set the cloud security baseline and guardrails for the organization, and decide which controls are enforced automatically versus left to review.
- Asset Inventory and Attack Surface Management — You can build continuous attack surface monitoring into how the organization ships infrastructure, and reduce a whole category of exposure rather than one instance at a time.
- Secure Configuration and Hardening — You can run baseline compliance across many types of system and rule on each exception according to the risk it carries.

Resilience
- Cyber Resilience and Recovery — You can set the criteria that declare recovery complete, and show executives whether recovery targets hold after a destructive attack.

Identity and Access
- Identity and Access Governance — You can defend access governance across many systems to an auditor, and redesign reviews that reviewers approve without checking.
- Privileged Access Management — You can bring privileged access under control where admin accounts are shared or embedded in scripts, and get owners to agree the migration.
- Identity Federation and Single Sign-On — You can federate across organizational boundaries, including mergers and partner tenants with conflicting identity sources, and restore sign-on for everyone when a broken trust locks users out.

Secure Architecture
- Security Architecture Design — You can set the reference architectures and cryptographic standards teams build on, and plan for replacing an algorithm without redesigning systems.
- Threat Modeling — You can decide how and when the organization threat models, and show that the practice changes what gets built. You get teams to model their own systems without you in the room.
- Application Security Testing — You can test applications and APIs whose weakness only appears across components, and set the pipeline gates and triage rules that decide what blocks a release.
- Secure Code Review — You can review code whose weakness spans files, frameworks or trust boundaries, and decide which findings, including pipeline scanner results, should block a release.
- Security Requirements and Design Review — You can set which changes need review, what the standing requirements are, and where teams may assess themselves. You get design review treated as help early rather than a gate at the end.

Governance and Risk
- Security Risk Assessment — You can set how the organization measures and reports security risk, including its appetite and its escalation thresholds. You get executives to act on the risks that matter and to stop spending on the ones that do not.
- Security Policy Management — You can decide the policy and control framework the organization runs by, and which external standards it commits to certify against.
- Supply Chain and Third-Party Security Risk — You can assess critical suppliers and the provenance of what they ship, and lead the response when one is breached.
- Security Awareness Program Management — You can move awareness from a completion figure to a measured change in behavior, including with audiences who have tuned security training out for years. You handle it when a simulation lands badly with senior staff.
- Security Metrics and Reporting — You can report on areas where the data is incomplete or easy to game, and say plainly what the numbers cannot tell you. You retire metrics that people have learned to hit without becoming any safer.
- Security Control Testing and Assurance — You can set how often and how independently controls are tested, and report to the board how far control claims are backed by evidence.

Delivery
- Project Management — You can set the everyday habits for how work is organized and followed up across the organization, and teams you do not lead adopt the routines you introduce.
- Planning & Estimation — You can forecast work and staffing quarters ahead, and set the estimating method other teams use.
- Ownership & Accountability — You can report the organization's most exposed outcomes to its leaders as they stand, including bad news, and answer for them.
- Quality Focus — You can raise the quality bar across the organization by building the tools and habits that make the careful way the easy way.

Craft
- Problem Solving — You can crack problems the organization has repeatedly failed to solve, and your approach becomes how others tackle that whole kind of problem.
- Domain Expertise — You can influence how the field is practiced beyond this organization, and your expertise settles questions that have stood open for years.
- Continuous Learning — You can set what the organization invests its learning time in, and the material and practice you create outlive your involvement.

Communication
- Communication — You can set how the organization communicates by creating the forums and norms that teams use to share information.
- Collaboration — You can remove the barriers that stop teams working together by putting in place routines and forums they use across the organization.
- Writing & Documentation — You can set the writing standard the organization works to, and documents you wrote are still in use long after you have moved on.
- Stakeholder Management — You can represent the organization in its most important relationships and set how it engages with everyone who depends on it.

Leadership
- Leadership — You can set direction for the whole organization, make hard calls under real uncertainty, and carry the decisions nobody else wants to own.
- Mentoring — You can shape how the organization grows its people, and those you developed are themselves named by others as strong in their field.
- Strategic Thinking — You can shape the organization's strategy, and the bets you argued for are visible in where it ended up.

REQUIRED CERTIFICATIONS
- CompTIA Security+ (required from Senior Security Analyst)
- GIAC Certified Incident Handler (GCIH) (required from Security Engineer)
- OffSec Certified Professional (OSCP) (required from Security Engineer)
- Certified Cloud Security Professional (CCSP) (required from Senior Security Engineer)
- Certified Information Systems Security Professional (CISSP) (required from Principal Security Engineer)