Security Engineer

• 3 to 5+ years in information security or IT, including 2+ years of hands-on compliance work \n

• Experience taking a company through a full audit using Vanta, Drata, or Secureframe \n

• Hands-on EDR and MDM administration \n

• Okta or Entra ID experience \n

• Google Workspace or Microsoft 365 security, plus experience with a major cloud platform \n

• Vulnerability management and incident response experience \n

• Solid grasp of SOC 2, ISO 27001, and NIST CSF, with the ability to write audit-ready policies

n \n

• Lead clients through SOC 2 and ISO 27001 audits, from readiness assessment and remediation through evidence collection and auditor coordination \n

• Manage the firm’s internal compliance program using Vanta \n

• Develop compliance roadmaps tied to client growth stages, fundraising, and IPO preparation \n

• Write and maintain security policies (incident response, access control, acceptable use, AI usage, BCDR, WISP) aligned with NIST, SEC Reg S-P, GDPR, and CCPA \n

\n

Vendor Risk & Client Assurance

\n \n

• Build and maintain client Trust Centers and complete security questionnaires (SIG, CAIQ, RFPs) \n

• Assess new vendors and AI tools and advise clients on adoption \n

• Maintain vendor inventories, risk tiers, and attestations, and refine the TPRM process \n

\n

Security Engineering

\n \n

• Deploy and manage EDR (SentinelOne) and MDM (Jamf, Mosyle, Intune) across Mac and Windows environments \n

• Strengthen identity and access controls with Okta, MFA, and 1Password \n

• Secure Google Workspace, Microsoft 365, and other SaaS and cloud platforms \n

\n

Security Operations

\n \n

• Triage alerts across endpoint, identity, email, and cloud, and lead incident response and post incident reviews \n

• Own vulnerability management and pen test remediation \n

• Maintain logging and SIEM sources, and run access reviews and configuration audits \n

• Run security awareness training and phishing simulations (KnowBe4, Adaptive) \n

\n

\n