Security Engineer job description

Cybersecurity — Security Engineer
Builds and hardens security controls across a domain.

RESPONSIBILITIES
- Build detection coverage for a whole class of technique, prioritize which gaps matter most, and coach others in writing rules that hold up in production.
- Plan and run a test against a more complex environment, develop a proof of concept for a finding that tooling alone did not confirm, and write a report a system owner can act on.
- Design federation for an application with awkward requirements, and document what each trust decision hands to the other party.
- Own the security design for a whole service, from encryption algorithms and key custody to controls that fit its risk.
- Test applications and APIs whose weakness only appears across components, and set the pipeline gates and triage rules that decide what blocks a release.
- Review a proposed system on your own, tell a required control apart from a preference, and give the project a decision it can build against rather than a list of concerns.

REQUIREMENTS
- Experience at the Senior Security Analyst level (level 2 of 5) or equivalent
- Holds CompTIA Security+, GIAC Certified Incident Handler (GCIH) and OffSec Certified Professional (OSCP)

REQUIRED SKILLS
Threat Operations
- Security Alert Triage — You can tune triage criteria and playbooks from what past alerts revealed, cutting noise without hiding a real signal, and review contested calls made by other analysts.
- Threat Detection Engineering — You can build detection coverage for a whole class of technique, prioritize which gaps matter most, and coach others in writing rules that hold up in production.
- SIEM Monitoring and Tuning — You can plan SIEM capacity and log source coverage against real detection needs, and lead a platform migration without a monitoring gap.
- Incident Response Coordination — You can command a major incident, balancing containment, evidence and notification duties, and run the review that changes something.
- Digital Forensics and Evidence Handling — You can reconstruct a timeline of attacker activity across several systems from disk, memory and log evidence, and get a second review of any finding that rests on one source.
- Threat Intelligence Analysis — You can assess the credibility and relevance of a new intelligence source, and translate known techniques used by a threat actor into specific defensive changes.

Exposure Management
- Vulnerability Scanning and Triage — You can validate whether a critical finding is actually exploitable in this environment before it triggers an emergency response, and improve the scanning program from what was missed.
- Vulnerability Remediation Coordination — You can negotiate a realistic remediation plan with a resistant system owner, and decide when a temporary compensating control is good enough to hold the risk.
- Penetration Testing and Exploitation — You can plan and run a test against a more complex environment, develop a proof of concept for a finding that tooling alone did not confirm, and write a report a system owner can act on.
- Cloud Security Posture Management — You can define the baseline a cloud environment should be checked against, and investigate why a class of finding keeps recurring rather than fixing each instance.
- Asset Inventory and Attack Surface Management — You can find unmanaged exposure such as forgotten infrastructure or shadow IT, and get it decommissioned or brought under control.
- Secure Configuration and Hardening — You can write the hardening baseline for a new type of system, and set up checks that report drift from it.

Resilience
- Cyber Resilience and Recovery — You can protect backups from alteration or deletion by an attacker, and test that a clean restore works when the main environment is compromised.

Identity and Access
- Identity and Access Governance — You can design an access review process for a new system, decide what evidence a reviewer actually needs to make a real decision, and act on stale or excessive access it turns up.
- Privileged Access Management — You can design the privileged access model for a system, deciding which accounts are vaulted, how long a session lasts and what gets recorded. You handle break-glass access without leaving a standing privilege behind.
- Identity Federation and Single Sign-On — You can design federation for an application with awkward requirements, and document what each trust decision hands to the other party.

Secure Architecture
- Security Architecture Design — You can own the security design for a whole service, from encryption algorithms and key custody to controls that fit its risk.
- Threat Modeling — You can facilitate threat modeling for a system you did not build, covering AI components such as prompt injection, and turn the output into work that gets done.
- Application Security Testing — You can test applications and APIs whose weakness only appears across components, and set the pipeline gates and triage rules that decide what blocks a release.
- Secure Code Review — You can review unfamiliar code and find the security flaw in its logic, not just in its patterns, including the authorization check that is missing rather than wrong.
- Security Requirements and Design Review — You can review a proposed system on your own, tell a required control apart from a preference, and give the project a decision it can build against rather than a list of concerns.

Governance and Risk
- Security Risk Assessment — You can assess risk for a project or system independently, including privacy risk to personal data, and get a named owner to accept or treat it.
- Security Policy Management — You can write a policy or standard people can follow, covering privacy duties and acceptable AI use, and take it through consultation and approval.
- Supply Chain and Third-Party Security Risk — You can check the evidence a supplier provides beyond the questionnaire, and record its criticality tier and residual risk.
- Security Awareness Program Management — You can design awareness activity for a specific audience and threat, pick a simulation difficulty that teaches rather than shames, and show whether reporting behavior changed.
- Security Metrics and Reporting — You can choose metrics that answer a real question about exposure, build them from sources you have verified, and write a report a non-technical reader can act on.
- Security Control Testing and Assurance — You can plan and run an assessment of the controls on a system, and write findings that state the control, the evidence and the gap.

Delivery
- Project Management — You can coordinate a small team's work on a shared goal: who does what by when, what has to wait for what, and a revised plan when things change.
- Planning & Estimation — You can estimate a whole project including its risks and unknowns, split it into stages, and defend the estimate when it is challenged.
- Ownership & Accountability — You can hold accountability for outcomes delivered mostly by other people, taking the blame when it fails and passing on the credit when it works.
- Quality Focus — You can set how quality is checked on complex work shared by several teams, and you spot the problems that only appear where their pieces meet.

Craft
- Problem Solving — You can make the call on a problem outside your expertise and explain its cost, time and risk.
- Domain Expertise — You can advise the team on your area and apply new developments in the field where they pay off.
- Continuous Learning — You can judge which new ideas are worth the team's time and which are not, and you make room for the people around you to learn too.

Communication
- Communication — You can bring disagreeing groups to agreement on the facts and the next steps, and help colleagues frame a difficult or sensitive message.
- Collaboration — You can align teams with competing priorities on a common goal, surfacing the conflict early instead of letting it harden into resentment.
- Writing & Documentation — You can own the documents behind a large piece of work, coordinating contributions so that people who were not involved can carry it on.
- Stakeholder Management — You can win support for a proposal, reset expectations when the plan changes, and turn down a request with a reason the other side accepts.

Leadership
- Leadership — You can lead one piece of work shared by several people, on your own team and beyond, and make calls that they act on.
- Mentoring — You can mentor someone over months, tell them the uncomfortable thing they need to hear, and adapt how you teach to how they learn.
- Strategic Thinking — You can look a year ahead in your area, name what will matter by then, and turn that into work people can pick up now.

REQUIRED CERTIFICATIONS
- CompTIA Security+ (required from Senior Security Analyst)
- GIAC Certified Incident Handler (GCIH) (required from Security Engineer)
- OffSec Certified Professional (OSCP) (required from Security Engineer)