Senior Security Engineer job description

Cybersecurity — Senior Security Engineer
Owns a domain and leads response to major incidents.

RESPONSIBILITIES
- Assess critical suppliers and the provenance of what they ship, and lead the response when one is breached.
- Set the incident response program for the organization, including who has authority to declare and close an incident, and represent the organization to regulators or the board after a serious breach.
- Lead forensic investigation of a complex intrusion spanning cloud and on-premises systems, and present findings that survive challenge from legal or a regulator.
- Run a structured intelligence program that prioritizes collection against the threats the organization actually faces, and brief technical findings to non-technical leaders.
- Run remediation across a portfolio of systems with competing priorities, and report exposure trends in terms leadership will act on.
- Scope and lead a test involving several systems or a red-team-style exercise, and judge when a finding is too dangerous to demonstrate live rather than describe.

REQUIREMENTS
- Experience at the Security Engineer level (level 3 of 5) or equivalent
- Holds CompTIA Security+, GIAC Certified Incident Handler (GCIH), OffSec Certified Professional (OSCP) and Certified Cloud Security Professional (CCSP)

REQUIRED SKILLS
Threat Operations
- Security Alert Triage — You can tune triage criteria and playbooks from what past alerts revealed, cutting noise without hiding a real signal, and review contested calls made by other analysts.
- Threat Detection Engineering — You can build detection coverage for a whole class of technique, prioritize which gaps matter most, and coach others in writing rules that hold up in production.
- SIEM Monitoring and Tuning — You can plan SIEM capacity and log source coverage against real detection needs, and lead a platform migration without a monitoring gap.
- Incident Response Coordination — You can set the incident response program for the organization, including who has authority to declare and close an incident, and represent the organization to regulators or the board after a serious breach.
- Digital Forensics and Evidence Handling — You can lead forensic investigation of a complex intrusion spanning cloud and on-premises systems, and present findings that survive challenge from legal or a regulator.
- Threat Intelligence Analysis — You can run a structured intelligence program that prioritizes collection against the threats the organization actually faces, and brief technical findings to non-technical leaders.

Exposure Management
- Vulnerability Scanning and Triage — You can validate whether a critical finding is actually exploitable in this environment before it triggers an emergency response, and improve the scanning program from what was missed.
- Vulnerability Remediation Coordination — You can run remediation across a portfolio of systems with competing priorities, and report exposure trends in terms leadership will act on.
- Penetration Testing and Exploitation — You can scope and lead a test involving several systems or a red-team-style exercise, and judge when a finding is too dangerous to demonstrate live rather than describe.
- Cloud Security Posture Management — You can drive posture improvement across multiple cloud accounts and providers, and stop a risky deployment pattern by changing how it is provisioned rather than by policing it after the fact.
- Asset Inventory and Attack Surface Management — You can build continuous attack surface monitoring into how the organization ships infrastructure, and reduce a whole category of exposure rather than one instance at a time.
- Secure Configuration and Hardening — You can run baseline compliance across many types of system and rule on each exception according to the risk it carries.

Resilience
- Cyber Resilience and Recovery — You can set the criteria that declare recovery complete, and show executives whether recovery targets hold after a destructive attack.

Identity and Access
- Identity and Access Governance — You can defend access governance across many systems to an auditor, and redesign reviews that reviewers approve without checking.
- Privileged Access Management — You can bring privileged access under control where admin accounts are shared or embedded in scripts, and get owners to agree the migration.
- Identity Federation and Single Sign-On — You can federate across organizational boundaries, including mergers and partner tenants with conflicting identity sources, and restore sign-on for everyone when a broken trust locks users out.

Secure Architecture
- Security Architecture Design — You can design for systems with competing constraints, legacy dependencies or regulatory obligations, and get tradeoffs agreed with the engineers who build them.
- Threat Modeling — You can threat model systems with complex trust relationships, supply chains or unclear ownership, and separate the threats worth spending on from the ones worth accepting. You change the method when it stops finding anything.
- Application Security Testing — You can test applications and APIs whose weakness only appears across components, and set the pipeline gates and triage rules that decide what blocks a release.
- Secure Code Review — You can review code whose weakness spans files, frameworks or trust boundaries, and decide which findings, including pipeline scanner results, should block a release.
- Security Requirements and Design Review — You can review designs where security requirements conflict with cost, delivery date or an existing platform, and land an agreed position with conditions attached. You are brought in when a project and security have deadlocked.

Governance and Risk
- Security Risk Assessment — You can assess risk where the impact is uncertain or contested, and give decision-makers a real choice rather than a color on a heat map. You challenge a rating that has been set to suit the answer someone wanted.
- Security Policy Management — You can rework a policy set that has drifted from practice, and decide whether to change the policy or the practice while keeping within privacy law.
- Supply Chain and Third-Party Security Risk — You can assess critical suppliers and the provenance of what they ship, and lead the response when one is breached.
- Security Awareness Program Management — You can move awareness from a completion figure to a measured change in behavior, including with audiences who have tuned security training out for years. You handle it when a simulation lands badly with senior staff.
- Security Metrics and Reporting — You can report on areas where the data is incomplete or easy to game, and say plainly what the numbers cannot tell you. You retire metrics that people have learned to hit without becoming any safer.
- Security Control Testing and Assurance — You can run an internal audit of a control framework, and defend its sampling and conclusions to an external auditor or regulator.

Delivery
- Project Management — You can keep several people's work in step across teams, agree priorities and hand-offs with them, and keep one shared task list that all of them actually use.
- Planning & Estimation — You can estimate work that spans several teams, name the assumptions behind each figure, and rework the plan when those assumptions break.
- Ownership & Accountability — You can hold accountability for outcomes delivered mostly by other people, taking the blame when it fails and passing on the credit when it works.
- Quality Focus — You can set how quality is checked on complex work shared by several teams, and you spot the problems that only appear where their pieces meet.

Craft
- Problem Solving — You can make the call on a problem outside your expertise and explain its cost, time and risk.
- Domain Expertise — You can bring in good practice from outside the organization and make it work here, and your judgment clearly improves the work you touch.
- Continuous Learning — You can judge which new ideas are worth the team's time and which are not, and you make room for the people around you to learn too.

Communication
- Communication — You can bring disagreeing groups to agreement on the facts and the next steps, and help colleagues frame a difficult or sensitive message.
- Collaboration — You can align teams with competing priorities on a common goal, surfacing the conflict early instead of letting it harden into resentment.
- Writing & Documentation — You can own the documents behind a large piece of work, coordinating contributions so that people who were not involved can carry it on.
- Stakeholder Management — You can hold senior and external relationships, negotiate between competing demands, and deliver unwelcome news without losing trust.

Leadership
- Leadership — You can lead across team boundaries, build the credibility that makes people follow you by choice, and create room for others to lead.
- Mentoring — You can develop other mentors, coach people through career decisions rather than tasks, and lift the capability of a whole team.
- Strategic Thinking — You can set direction for an area, choose deliberately what not to do, and defend that choice when it is challenged.

REQUIRED CERTIFICATIONS
- CompTIA Security+ (required from Senior Security Analyst)
- GIAC Certified Incident Handler (GCIH) (required from Security Engineer)
- OffSec Certified Professional (OSCP) (required from Security Engineer)
- Certified Cloud Security Professional (CCSP) (required from Senior Security Engineer)