OnTrac is hiring a Sr Cyber Security Engineer (PAM / IAM)!
If you possess a strong sense of empathy, enjoy assisting others, thrive in a fast-paced environment, and excel at problem-solving,
S. for premier e-commerce and product-supply businesses, including five of the largest retailers in the U.Remote - This position may be performed remotely in states where the company is authorized to employ individuals.
Actual compensation will be determined based on experience, skills, internal equity, and other job-related factors.
This position may also be eligible for bonus, commission, or other incentive compensation in accordance with the terms of the applicable plan of up to a 20% Bonus Target.
Cyber Security Engineer is a senior-level individual contributor and hands-on technical owner for Identity and Access Management (IAM), Privileged Access Management (PAM), Entra ID, Microsoft 365, vulnerability management, and mobile device management. This broad security engineering role requires deep identity expertise alongside the ability to support endpoint, cloud, and SaaS security. The Engineer partners daily with IT to secure infrastructure and end-user services, enables the Cyber Security Incident Response Team (CSIRT) as a Tier 3 escalation point, and supports Governance, Risk, and Compliance (GRC) by translating control requirements into technical configurations and automated evidence collection.
Medical, dental, and vision insurance
~ Life and short- and long-term disability coverage
~401(k) retirement savings plan with company match
~ Flex vacation in states other than CA, CO, IL, MA, MT, and NE, with accruals up to 96 hours for first year of employment with tenure-based increases up to 160 hours
~ Two (2) floating holidays per year
~ Six (6) paid company holidays
~ Two (2) weeks paid pregnancy disability leave, four (4) weeks paid parental bonding leave
~ Additional wellness and employee assistance programs
Benefits eligibility and offerings are subject to the terms and conditions of the applicable plans and company policies.
Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience
~7+ years of progressive experience in IT and Security, including at least 3 years dedicated to IAM or security engineering in an enterprise environment
~ Entra ID / Microsoft 365
~ A PAM platform
~ Qualys or equivalent vulnerability management platform
~ Intune / JAMF device management
~ Strong working knowledge of Entra ID, including Conditional Access, Identity Protection, PIM, and entitlement management, plus the Microsoft 365 security and compliance stack
~ Working knowledge of Intune, JAMF, and Google device management, including compliance policies, configuration profiles, and application deployment across mixed operating-system environments
~ Strong scripting and automation skills using PowerShell, Microsoft Graph, Python, or Bash
~ Certifications such as SC-300, SC-200, AZ-500, CISSP, CISM, GIAC GCIA, GIAC GDSA, or relevant PAM, JAMF, or Qualys vendor certifications
~ Ability to travel up to 10%
~ It is the responsibility of every position to understand and adhere to the security guidelines outlined in OnTrac’s Acceptable Use policy and to conduct their activities accordingly.
Design, deploy, and maintain enterprise identity services across Entra ID and hybrid Active Directory, including SAML/OIDC federation, SSO, Conditional Access, MFA and phishing-resistant authentication, joiner/mover/leaver automation, RBAC, role and group governance, access reviews, credential vaulting, session monitoring, just-in-time elevation, tiered administration, service-account governance, and break-glass procedures.
Microsoft 365 and Entra ID security: Harden and administer Exchange Online, SharePoint, OneDrive, Teams, Defender, Purview, and the Entra ID tenant, including configuration baselines, application registration and OAuth consent governance, license-aligned feature enablement, and posture remediation.
Operate Qualys, including asset coverage, tagging, authenticated scanning, agents, policy compliance, and risk-based reporting; and manage compliance, configuration, enrollment, encryption, patching, application deployment, and device-posture signals across Intune, JAMF, and Google device management for Windows, macOS, iOS, and Android.
IT partnership and security by design: Serve as the embedded security engineering partner for directory, endpoint, network, and infrastructure changes, applying security by design to projects, migrations, and new deployments without unnecessarily slowing delivery.
Support complex identity and endpoint incidents through containment actions, including token revocation, account disablement, and device isolation; assist with evidence collection, log-source onboarding, and detection tuning in partnership with CSIRT and the MDR provider.
Translate requirements from NIST CSF, ISO 27001, and SOC 2 into technical configurations and automated evidence collection that supports audits, third-party risk reviews, and risk-remediation tracking.
Automate recurring identity, access, integration, and reporting tasks using PowerShell, Microsoft Graph, and Python; maintain runbooks, SOPs, architecture diagrams, and platform standards; Paving your way to your success
You explain technical risk clearly to non-technical stakeholders and collaborate effectively across IT, CSIRT, GRC, and business teams.
You bring proficiency across identity, endpoint, network security, cloud environments including Azure, GCP, and AWS, and SaaS administration, moving effectively between domains as priorities shift.
The salary range may be inclusive of several career levels at OnTrac, and the actual base salary offered may vary depending on several factors including, but not limited to: Geographic location, candidate experience and qualifications, job-related skills and competencies, market alignment, and financial considerations.
If you require reasonable accommodation to participate in the application or interview process, perform essential job functions, or access other employment benefits, please contact Human Resources.
We value diversity and welcome applications from individuals of all backgrounds, abilities, and experiences. We do not discriminate based on race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or age.
If you possess a strong sense of empathy, enjoy assisting others, thrive in a fast-paced environment, and excel at problem-solving,
S. for premier e-commerce and product-supply businesses, including five of the largest retailers in the U.Remote - This position may be performed remotely in states where the company is authorized to employ individuals.
Actual compensation will be determined based on experience, skills, internal equity, and other job-related factors.
This position may also be eligible for bonus, commission, or other incentive compensation in accordance with the terms of the applicable plan of up to a 20% Bonus Target.
Cyber Security Engineer is a senior-level individual contributor and hands-on technical owner for Identity and Access Management (IAM), Privileged Access Management (PAM), Entra ID, Microsoft 365, vulnerability management, and mobile device management. This broad security engineering role requires deep identity expertise alongside the ability to support endpoint, cloud, and SaaS security. The Engineer partners daily with IT to secure infrastructure and end-user services, enables the Cyber Security Incident Response Team (CSIRT) as a Tier 3 escalation point, and supports Governance, Risk, and Compliance (GRC) by translating control requirements into technical configurations and automated evidence collection.
Medical, dental, and vision insurance
~ Life and short- and long-term disability coverage
~401(k) retirement savings plan with company match
~ Flex vacation in states other than CA, CO, IL, MA, MT, and NE, with accruals up to 96 hours for first year of employment with tenure-based increases up to 160 hours
~ Two (2) floating holidays per year
~ Six (6) paid company holidays
~ Two (2) weeks paid pregnancy disability leave, four (4) weeks paid parental bonding leave
~ Additional wellness and employee assistance programs
Benefits eligibility and offerings are subject to the terms and conditions of the applicable plans and company policies.
Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience
~7+ years of progressive experience in IT and Security, including at least 3 years dedicated to IAM or security engineering in an enterprise environment
~ Entra ID / Microsoft 365
~ A PAM platform
~ Qualys or equivalent vulnerability management platform
~ Intune / JAMF device management
~ Strong working knowledge of Entra ID, including Conditional Access, Identity Protection, PIM, and entitlement management, plus the Microsoft 365 security and compliance stack
~ Working knowledge of Intune, JAMF, and Google device management, including compliance policies, configuration profiles, and application deployment across mixed operating-system environments
~ Strong scripting and automation skills using PowerShell, Microsoft Graph, Python, or Bash
~ Certifications such as SC-300, SC-200, AZ-500, CISSP, CISM, GIAC GCIA, GIAC GDSA, or relevant PAM, JAMF, or Qualys vendor certifications
~ Ability to travel up to 10%
~ It is the responsibility of every position to understand and adhere to the security guidelines outlined in OnTrac’s Acceptable Use policy and to conduct their activities accordingly.
Design, deploy, and maintain enterprise identity services across Entra ID and hybrid Active Directory, including SAML/OIDC federation, SSO, Conditional Access, MFA and phishing-resistant authentication, joiner/mover/leaver automation, RBAC, role and group governance, access reviews, credential vaulting, session monitoring, just-in-time elevation, tiered administration, service-account governance, and break-glass procedures.
Microsoft 365 and Entra ID security: Harden and administer Exchange Online, SharePoint, OneDrive, Teams, Defender, Purview, and the Entra ID tenant, including configuration baselines, application registration and OAuth consent governance, license-aligned feature enablement, and posture remediation.
Operate Qualys, including asset coverage, tagging, authenticated scanning, agents, policy compliance, and risk-based reporting; and manage compliance, configuration, enrollment, encryption, patching, application deployment, and device-posture signals across Intune, JAMF, and Google device management for Windows, macOS, iOS, and Android.
IT partnership and security by design: Serve as the embedded security engineering partner for directory, endpoint, network, and infrastructure changes, applying security by design to projects, migrations, and new deployments without unnecessarily slowing delivery.
Support complex identity and endpoint incidents through containment actions, including token revocation, account disablement, and device isolation; assist with evidence collection, log-source onboarding, and detection tuning in partnership with CSIRT and the MDR provider.
Translate requirements from NIST CSF, ISO 27001, and SOC 2 into technical configurations and automated evidence collection that supports audits, third-party risk reviews, and risk-remediation tracking.
Automate recurring identity, access, integration, and reporting tasks using PowerShell, Microsoft Graph, and Python; maintain runbooks, SOPs, architecture diagrams, and platform standards; Paving your way to your success
You explain technical risk clearly to non-technical stakeholders and collaborate effectively across IT, CSIRT, GRC, and business teams.
You bring proficiency across identity, endpoint, network security, cloud environments including Azure, GCP, and AWS, and SaaS administration, moving effectively between domains as priorities shift.
The salary range may be inclusive of several career levels at OnTrac, and the actual base salary offered may vary depending on several factors including, but not limited to: Geographic location, candidate experience and qualifications, job-related skills and competencies, market alignment, and financial considerations.
If you require reasonable accommodation to participate in the application or interview process, perform essential job functions, or access other employment benefits, please contact Human Resources.
We value diversity and welcome applications from individuals of all backgrounds, abilities, and experiences. We do not discriminate based on race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or age.
Cyber Content Engineering and Automation in virginia at Unknown Company
This position is listed as full time and able to be worked remotely.