> Markdown version of [/jobs/ext/1502211-security-engineer](https://www.wearedevelopers.com/jobs/ext/1502211-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Engineer - **Company:** Sierra Central Credit Union - **Location:** Yuba City, CA, United States - **Experience:** Experienced - **Salary:** $120,000.0 - $145,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Software System Penetration Testing, Cloud Computing, Cloud Computing Security, Cyber Security, Information Systems, Data Security, Domainkeys Identified Mail, Domain-Based Message Authentication Reporting and Conformance (DMARC), Virtual Private Networks (VPN), Network Security, Log Analysis, OAuth, Remote File Sharing, Phishing, Kusto Query Language, Microsoft SharePoint, Security Information and Event Management, Simulation Software, Software Vulnerability Management, Data Classification, Firewalls (Computer Science), Microsoft InTune, Sender Policy Framework (SPF), Spoofing, Information Technology, Microsoft Sentinel - **Published:** July 30, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=3a50332b64b1c153 ## About the Role What You Bring (Required) * Minimum 4 years of hands-on security engineering experience, including significant time in a Microsoft-centric enterprise environment. * Deep working knowledge of Microsoft 365 E5 security and compliance capabilities and cloud file sharing technologies (SharePoint Online, OneDrive, Teams governance, and DLP). * Knowledge and experience with firewalls, VPNs, and network security practices and tools. * Demonstrated incident investigation experience: log analysis, endpoint and identity forensics, and clear post-incident documentation. * Email security administration and phishing simulation program experience. * Working familiarity with risk management and audit practices in a regulated environment. * Strong written and verbal communication, comfortable explaining technical risk to both engineers and executives. * Ability to work onsite at our Yuba City headquarters. What Sets You Apart (Preferred) * Financial services or credit union experience; familiarity with NCUA and FFIEC regulatory expectations. * Certifications such as CISSP, CISM, GIAC, or Microsoft SC-200, SC-100, or SC-400. * SIEM engineering depth: KQL, analytics rule development, automation and SOAR workflows. * EDR operations experience and coordination with MSSP or MDR partners. * Privacy framework knowledge: GLBA, CCPA/CPRA. * A track record of mentoring, training, or developing junior staff. ## Description You will report to the VP of Information and Cyber Security and work alongside an Information Security Specialist as part of the Information Systems and Information Technology (ISIT) department. We are a Microsoft shop, and this role sits at the center of operationalizing a Microsoft 365 E5 security stack that is licensed but not yet fully deployed. If you want to build rather than maintain, this is that job., * Engineer, deploy, and tune the Microsoft 365 E5 security stack: Microsoft Sentinel, Defender XDR, Entra ID, Intune, Microsoft Purview (DLP, sensitivity labels, information protection), and Defender for Cloud Apps. * Secure cloud file sharing and collaboration across SharePoint Online, OneDrive, and Teams: tenant sharing policies, sensitivity labeling, DLP policy design in monitor and enforce modes, and OAuth application consent governance. * Administer and tune enterprise email security: secure gateway policy, anti-phishing and impersonation controls, and SPF, DKIM, and DMARC posture. * Own the phishing simulation and testing program end to end: campaign design, execution, click-rate and reporting metrics, and targeted remediation training. * Lead incident investigation and response in partnership with our managed detection and response provider: triage, containment, root-cause analysis, and post-incident reporting aligned to NCUA cyber incident notification requirements. * Support vulnerability management: scan result analysis, remediation coordination with infrastructure and systems teams, and penetration test scoping and remediation tracking. * Contribute to risk management and audit readiness: control design and evidence, support for NCUA examinations and internal and external audits, and third-party risk reviews. * Support the privacy and data protection program: data classification, insider risk monitoring, and GLBA Safeguards Rule alignment. * Mentor junior security staff and act as a security resource for IT peers and business units across the credit union. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Turning Container security up to 11 with Capabilities](https://www.wearedevelopers.com/videos/718-turning-container-security-up-to-11-with-capabilities) - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Getting under the skin: The Social Engineering techniques](https://www.wearedevelopers.com/videos/38-getting-under-the-skin-the-social-engineering-techniques) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)