> Markdown version of [/jobs/ext/602907-lead-cyber-security-engineer](https://www.wearedevelopers.com/jobs/ext/602907-lead-cyber-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead, Cyber Security Engineer - **Company:** W.W.Williams Company - **Location:** Irving, TX, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Access Network, Active Directory, Amazon Web Services, Proxy Servers, Microsoft Azure, Cloud Computing Security, Cyber Security, Digital Assets, Domainkeys Identified Mail, Domain-Based Message Authentication Reporting and Conformance (DMARC), Domain Name System (DNS), Identity and Access Management, Networking Hardware, Intrusion Detection and Prevention, Intrusion Detection Systems, Virtual Private Networks (VPN), Python (Programming Language), Key Management, Network Security, Network Forensics, Network Segmentation, PCI Data Security Standards, Performance Tuning, Windows PowerShell, Azure Active Directory, Phishing, Kusto Query Language, Zero Trust Network Access, Secure Coding, Security Information and Event Management, Software Vulnerability Management, Scripting, Cyberark, Mitre Att&ck, Mttr, Cyber Threat Analysis, Firewalls (Computer Science), Tenable Nessus, Patch Management, Microsoft Sentinel, CIS Benchmarks, Purple Team (Cyber Security), Splunk, SentinelOne Expertise, Qualys, Vulnerability Analysis - **Published:** June 20, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=6b1d8444b3d9ad3c ## About the Role Do you have experience in Zero Trust security?, * 8-10+ years of progressive, hands-on cyber security engineering experience in enterprise environments. * Demonstrated experience building or maturing a security program against a recognized framework (NIST CSF, NIST 800-53, CIS Controls, or ISO 27001). * Proven ability to define security baselines, measure current-state maturity, and track improvement over time using quantitative metrics. * Hands-on experience with KnowBe4 (administration, campaign design, reporting) or equivalent security awareness platforms. * Hands-on experience with Field Effect Covalence, CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR, or comparable MDR/XDR solutions. * Strong working knowledge of SIEM platforms (Microsoft Sentinel, Splunk, or equivalent); ability to write detection rules and build dashboards. * Solid understanding of network security principles: firewalls, IDS/IPS, NAC, VPN, ZTNA, and network traffic analysis. * Experience managing vulnerability scanners (Tenable Nessus / Security Center, Qualys, or Rapid7 InsightVM). * Proficiency with cloud security in at least one major cloud provider (Azure preferred); understanding of shared-responsibility model and CSPM tools. * Strong written and verbal communication skills; able to produce board-ready risk reports and technical runbooks alike., * CISSP, CISM, or GIAC certifications (GCIA, GCIH, GPEN) * Experience with Microsoft Sentinel & Defender 365 ecosystem * Scripting/automation skills (Python, PowerShell, KQL) * Familiarity with OT/ICS security considerations * Prior experience in distribution, logistics, or field-service industries * Purple team / adversary emulation experience (MITRE ATT&CK) * PAM tooling (CyberArk, BeyondTrust, or Delinea) * SOC 2 Type II, CMMC, or PCI-DSS compliance exposure ## Description The Lead, Cyber Security Engineer is a senior individual-contributor and team-lead role responsible for owning the end-to-end cyber security program at WW Williams. Reporting to CIO and based in the Dallas, Texas metro area, this hybrid role requires both strategic vision and deep technical execution. The successful candidate will establish measurable security baselines, drive the organization toward NIST Cybersecurity Framework (CSF) maturity, and act as the primary defender of WW Williams' digital assets across all business units., Security Program Leadership & Governance * Own, evolve, and communicate the WW Williams Cyber Security roadmap aligned to NIST CSF (Identify, Protect, Detect, Respond, Recover) functions. * Establish, document, and track security KPIs and KRIs to measure baseline performance, quantify risk reduction, and demonstrate continuous improvement to executive stakeholders. * Develop and maintain security policies, standards, and procedures in alignment with regulatory requirements and industry frameworks (NIST 800-53, CIS Controls). * Lead periodic cyber security maturity assessments; produce gap analyses with prioritized remediation roadmaps. * Manage relationships with MSSPs, vendors, and third-party assessors; conduct vendor security reviews. Threat Detection, Incident Response and Threat Intelligence * develop correlation rules and playbooks to minimize mean-time-to-detect (MTTD) and mean-time-to-respond (MTTR). * Lead incident response activities including containment, eradication, forensic investigation, and post-incident review (PIR). * Maintain threat intelligence feeds; translate threat actor TTPs (MITRE ATT&CK) into actionable defensive controls. * Conduct adversarial simulation exercises (purple team / tabletop) to validate detection and response capabilities. Endpoint, Network & Cloud Security * Administer and optimize advanced endpoint detection and response (EDR/XDR) platforms; enforce next-generation antivirus (NGAV) and behavioral anomaly detection policies. * Manage Field Effect Covalence (MDR) or equivalent managed detection and response solution; triage and act on platform alerts in concert with the SOC. * Oversee network security architecture including firewall rule-set management, IDS/IPS tuning, micro-segmentation, and zero-trust network access (ZTNA) initiatives. * Govern cloud security posture (CSPM) across Azure/AWS/GCP environments; enforce least-privilege IAM, secrets management, and cloud-native security controls. Security Awareness & Human-Layer Defense * Administer the KnowBe4 Security Awareness Training & Simulated Phishing platform; design targeted campaigns, track click-rate metrics, and report on risk reduction over time. * Drive a measurable reduction in human-layer risk through role-based training curricula, phishing simulations, and coaching for repeat offenders. * Serve as the internal security advocate; communicate risk in business terms to non-technical audiences including C-suite and field operations. Vulnerability Management & Secure Development * Own the full vulnerability management lifecycle: scan, prioritize (CVSS + business context), remediate, and verify closure within SLA. * Manage patch management cadences across servers, endpoints, OT/IoT-adjacent systems, and network devices. * Champion secure-by-design principles; conduct security design reviews and code-level assessments for internally developed applications. * Maintain a risk register and communicate residual risk posture to leadership on a regular cadence. Identity, Access & Data Protection * Govern privileged access management (PAM), MFA enforcement, and identity lifecycle processes in Active Directory / Azure AD / Entra ID. * Implement and maintain data loss prevention (DLP) controls; classify and protect sensitive business data across storage, transit, and endpoint. * Oversee email security stack (anti-phishing, DMARC/DKIM/SPF, secure email gateway) and web proxy / DNS filtering. ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [What Developers Get Wrong About Application Quality](https://www.wearedevelopers.com/videos/233-what-developers-get-wrong-about-application-quality) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)