Lead Information Security Engineer

As a member of the Information Services Department, the Lead Information Security Engineer is responsible for designing, implementing, and continuously improving security controls that protect the Firm’s networks, applications, endpoints, cloud environments, and data from evolving cyber threats. This role serves as a technical authority on security architecture, partnering with other Information Services teams to evaluate solutions, identify security risks, and ensure new technologies are securely designed and deployed from the ground up. The Lead Information Security Engineer provides technical leadership for key security platforms, resolves complex security challenges, and drives the continuous maturation of the Firm’s overall security architecture, capabilities, and risk management practices., * Design, engineer, and implement secure network solutions, cloud environments (Azure), and application security controls.

• Lead security architecture reviews for new technologies, applications, infrastructure, and cloud services; identify security risks and design gaps and provide technical recommendations to ensure solutions align with the firm’s security standards.
• Secure Azure resources and IaaS solutions to ensure new deployments meet security standards.
• Manage and onboard SIEM log sources, ensuring security-relevant logs are available and properly configured for use by the SOC team.
• Design, implement, and optimize data loss prevention (DLP) policies and secure web gateway (SWG) controls to protect sensitive data.
• Develop and maintain security standards, technical controls, and configuration guidelines for infrastructure, cloud, applications, and security technologies.
• Evaluate vulnerabilities and security findings, assess risk and business impact, and collaborate with technical teams to develop and implement appropriate remediation strategies.
• Provide engineering support during security incidents, including investigation, containment, remediation, and implementation of preventative controls.
• Evaluate security technologies, vendors, and solutions; participate in proof-of-concept activities and provide technical recommendations for security-related technology investments.

ADDITIONAL FUNCTIONS:

• Secure infrastructure and server environments, including virtual environments for Windows and Linux servers.
• Support and advance the organization’s zero trust network access (ZTNA) solution.
• Support and maintain certificate lifecycle management processes.
• Assist with securing and maintaining VMware environments.
• Contribute to identity and access management initiatives, including Azure Entra, LDAP, and SSO integrations.
• Partner with networking teams on networking security matters and network security architecture.
• Evaluate the security and privacy implications of AI tools and technologies and support the secure adoption of AI across the firm.
• Support email security tools, configurations, and related security controls.
• Participate in security projects and initiatives as assigned.

Information/Data Security (InfoSec), Internet Security, Security Architecture, Cloud Computing, Security Attacks, Continuous Improvement, Security Infrastructure, Technical Leadership, Risk Management, Risk Analysis, * Bachelor’s degree in information security or an equivalent combination of work and education required.

Experience:

• Minimum of five years of information security experience required including hands-on experience designing, implementing, and maintaining enterprise security technologies and controls.

Knowledge, Skills, & Abilities:

• Strong understanding of security architecture and cloud security principles, with hands-on experience securing Azure environments.
• Proficiency with firewalls and network security controls.
• Experience with SIEM tools, including log source onboarding, configuration, and management.
• Strong knowledge of identity and access management (IAM) concepts and technologies.
• Experience with endpoint detection and response (EDR) platforms and endpoint security controls.
• Familiarity with zero trust network access (ZTNA) architectures and security principles.
• Experience designing, administering, and optimizing data loss prevention (DLP) and secure web gateway (SWG) policies.
• Understanding of DNS security concepts and DNS-as-a-Service solutions.
• Ability to review and assess architecture plans for security risks, design gaps, and compliance with security standards.
• Experience with vulnerability assessment and remediation processes.
• Experience with scripting or automation languages such as PowerShell, Python, Bash, or similar.
• Ability to independently troubleshoot complex technical and security issues and develop effective solutions.
• Strong written and verbal communication skills, with the ability to communicate complex security risks and technical recommendations to both technical and non-technical stakeholders.
• Ability to work effectively and collaboratively with infrastructure, networking, cloud, identity, application, and other technical teams., Sedentary work: Exertion of physical strength to lift, carry, push, pull, or otherwise move objects up to 10 pounds. Work involves sitting most of the time. Walking and standing is often necessary in carrying out job duties.