> Markdown version of [/jobs/ext/4522972-security-engineer](https://www.wearedevelopers.com/jobs/ext/4522972-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer

- **Company:** THE PHOENIX
- **Location:** New York, NY, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Artificial Intelligence, Software System Penetration Testing, Bash Shell, Software as a Service, Cyber Security, Python (Programming Language), Windows PowerShell, Anti-Phishing, Security Information and Event Management, Software Vulnerability Management, Data Logging, Cloud Platform System, IT General Controls (ITGC), Okta, Microsoft InTune, National Institute of Standards and Technology Cybersecurity Framework, Casper Suite, Gsuite, SentinelOne Expertise
- **Published:** November 1, 2026
- **Apply:** https://www.juju.com/job/2_167785942

## About the Role

* 3 to 5+ years in information security or IT, including 2+ years of hands-on compliance work
 * Experience taking a company through a full audit using Vanta, Drata, or Secureframe
 * Hands-on xrbllit EDR and MDM administration
 * Okta or Entra ID experience
 * Google Workspace or Microsoft 365 security, plus experience with a major cloud platform
 * Vulnerability management and incident response experience
 * Solid grasp of SOC 2, ISO 27001, and NIST CSF, with the ability to write audit-ready policies

Nice to Have

 * Security+, CISSP, CISA, or ISO 27001 Lead Implementer
 * MSP or consulting background
 * SEC Reg S-P, SOX ITGC, or IPO readiness experience
 * AI tool risk assessments
 * Python, PowerShell, or Bash scripting

## Description

Compliance & Governance

 * Lead clients through SOC 2 and ISO 27001 audits, from readiness assessment and remediation through evidence collection and auditor coordination
 * Manage the firm's internal compliance program using Vanta
 * Develop compliance roadmaps tied to client growth stages, fundraising, and IPO preparation
 * Write and maintain security policies (incident response, access control, acceptable use, AI usage, BCDR, WISP) aligned with NIST, SEC Reg S-P, GDPR, and CCPA

Vendor Risk & Client Assurance

 * Build and maintain client Trust Centers and complete security questionnaires (SIG, CAIQ, RFPs)
 * Assess new vendors and AI tools and advise clients on adoption
 * Maintain vendor inventories, risk tiers, and attestations, and refine the TPRM process

Security Engineering

 * Deploy and manage EDR (SentinelOne) and MDM (Jamf, Mosyle, Intune) across Mac and Windows environments
 * Strengthen identity and access controls with Okta, MFA, and 1Password
 * Secure Google Workspace, Microsoft 365, and other SaaS and cloud platforms

Security Operations

 * Triage alerts across endpoint, identity, email, and cloud, and lead incident response and post incident reviews
 * Own vulnerability management and pen test remediation
 * Maintain logging and SIEM sources, and run access reviews and configuration audits
 * Run security awareness training and phishing simulations (KnowBe4, Adaptive)