IT Security Engineer - Team Lead

Security Operations

• Administer, tune, and maintain EDR, email security, SIEM, vulnerability scanning, and related security tools
• Monitor and triage alerts, perform investigations, and contain and remediate security incidents
• Active participant during incident response activities, document findings, and drive root cause and lessons learned reviews
• Run the vulnerability management lifecycle, including scanning, risk-based prioritization, remediation tracking, and exception management
• Manage phishing defense, including email filtering, DMARC, DKIM, SPF, user reported phish triage, and simulation campaigns
• Work with the MSSP to conduct threat hunting and build detection rules aligned to MITRE ATT&CK
• Support identity and access security, including MFA, privileged access, and periodic access reviews
• Define and enforce Service Level Agreements (SLAs) for vulnerability remediation based on severity and risk.

Security Initiatives

• Work with the CISO to plan and execute security projects from scoping through delivery, including tool deployments, upgrades, and control improvements
• Manage project timelines, dependencies, and coordination with infrastructure, application, and business teams
• Partner with the CISO and VP - Information Technology to evaluate new security technologies and recommend improvements to the security stack
• Participate in incident response planning, tabletop exercises, and root cause analysis.
• Translate complex security vulnerabilities into tangible business risks and opportunities for improvement for non-technical stakeholders. xrbllit

Team Leadership

• Guide and mentor a team of two to three security analysts
• Assign and prioritize daily work, review investigations, and serve as the escalation point
• Develop and maintain runbooks, procedures, and operational standards
• Support analyst growth through coaching, training, and certification goals

Reporting and Communication

• Report security metrics, incident summaries, and project status to VP - Information Technology and CISO
• Translate technical findings into clear business risk for leadership
• Support the CISO during internal audits, regulatory examinations, and third-party assessments with evidence and control walkthroughs
• Partner with IT teams to remediate findings and embed security into operations

• Bachelor’s degree in information technology, Cybersecurity, Computer Science, or equivalent experience
• 5+ years of hands-on cybersecurity experience, with deep focus on security technologies
• Direct administration experience with EDR or XDR platforms such as CrowdStrike, email security platforms such as Abnormal, vulnerability management systems such as Qualys or Rapid7, and managing MSSP partners.
• Proven experience managing incident investigations from detection through remediation
• Familiarity with Active Directory, Microsoft Entra ID, Microsoft 365, and Windows and Linux environments
• Experience leading projects or informally leading other analysts
• Strong written and verbal communication, with the ability to brief management on technical risk
• Familiarity with NIST CSF, CIS Controls, and MITRE ATT&CK
• Preferred experience in a regulated financial services environment supporting FFIEC, GLBA, SOX, or PCI DSS requirements or other highly regulated environment
• Scripting and automation skills in PowerShell or Python is valuable
• Exposure to Azure or AWS security, Zero Trust, and next generation firewalls
• One or more certifications such as Security+ or CySA+, or other security certifications