IT Security Specialist

The IT Security Specialist is DTLR's first dedicated security role, owning day-to-day protection of our corporate offices, distribution operations and retail stores. You will turn security work that is currently spread across the infrastructure, identity and helpdesk teams into a single, measurable program.

You will focus on identity and endpoint security across Microsoft 365 and Entra ID, PCI DSS compliance for store payment systems, security monitoring and first-line incident triage alongside our incident response vendor, partnering with network engineers to strengthen network security, and security awareness for corporate and store employees. This is a hands-on role with room to shape policies, tooling and the roadmap as the program grows.

Responsibilities:

Identity and access security

• Administer and harden Microsoft Entra ID security: Conditional Access, MFA, privileged access (PIM), and identity protection risk policies.
• Run periodic access reviews for privileged accounts, service accounts, guest users and cross-tenant access.
• Partner with the helpdesk on secure onboarding, offboarding and account-recovery procedures.

Endpoint, email and cloud security

• Manage Microsoft Defender (Endpoint, Office 365, Identity and Cloud Apps) and Intune security baselines across Windows, mobile and Android store devices.
• Tune email security, phishing protection and data loss prevention policies in Microsoft 365.
• Track vulnerabilities and drive patch and remediation timelines with system owners.

Payment and compliance

• Own day-to-day PCI DSS compliance activities: scope tracking, quarterly scans, evidence collection and annual assessment support.
• Help keep cardholder data environments segmented and minimized as store POS and payment systems change.
• Maintain security policies, standards and a risk register; support vendor security reviews.

Monitoring, triage and vendor coordination

• Monitor security alerts from Defender and other tools; triage, investigate and resolve lower-severity findings in-house.
• Escalate major incidents to our outsourced incident response vendor and act as DTLR's primary technical liaison during their engagement.
• Manage the vendor relationship: escalation criteria, contact paths, retainer terms and post-incident reviews.
• Maintain internal playbooks for the activities handled in-house and for the handoff to the vendor.
• Work with the infrastructure team to confirm backups are protected and recoverable (immutability, isolation, restore testing).

Network security

• Partner with DTLR's network engineers to understand the corporate, store and distribution network architecture, including the Cloudflare services they manage.
• Review firewall, VPN, Wi-Fi, segmentation and Cloudflare configurations from a security perspective and recommend improvements.
• Identify network security gaps and risks, and work with the network team to prioritize and track remediation.
• Assess security of new network, cloud and SaaS deployments before go-live.

Awareness and enablement

• Run security awareness training and phishing simulations for corporate and store employees.
• Serve as the escalation point for security questions from the helpdesk and business teams.
• Report program metrics and top risks to IT leadership monthly.

Required qualifications

• 3+ years in IT, with at least 2 years focused on information security, systems administration or security operations.
• Hands-on experience with Microsoft 365 and Entra ID security, including Conditional Access and MFA.
• Working experience with an EDR/XDR platform, preferably Microsoft Defender.
• Solid understanding of networking fundamentals: TCP/IP, DNS, firewalls, VPNs and network segmentation.
• Experience investigating security alerts and documenting incidents.
• Familiarity with PCI DSS or a comparable compliance framework (NIST CSF, CIS Controls, SOC 2).
• Bachelor's degree in IT, cybersecurity or a related field, or equivalent experience.
• Ability to participate in an on-call rotation for security incidents.

Preferred qualifications

• Experience in retail or another multi-site environment with point-of-sale and payment systems.
• Experience with Microsoft Sentinel or another SIEM, including writing KQL queries and detection rules.
• Experience securing Android or other mobile device fleets through Intune or a similar MDM.
• Familiarity with Cloudflare security services (WAF, Zero Trust, DNS); exposure to Meraki or other cloud-managed network platforms.
• Familiarity with backup security practices such as immutable storage and recovery testing.
• Scripting skills in PowerShell or Python for automation and investigations.
• One or more certifications: CompTIA Security+ or CySA+, Microsoft SC-200 or SC-300, SSCP, GIAC (GSEC, GCIH), or CISSP for senior candidates.

Skills and competencies

• Risk judgment: weighs security against store operations and picks practical controls over perfect ones.
• Clear communication: explains risks and incidents to executives, store managers and helpdesk staff in plain language.
• Ownership: sees issues through to closure and keeps documentation current.
• Calm under pressure: leads an orderly response during active incidents.
• Collaboration: works across infrastructure, identity, helpdesk, finance and loss prevention teams.
• Continuous learning: keeps up with threats targeting retail, payments and Microsoft environments.

Working conditions

• Hybrid schedule (remote considered), with occasional travel to stores and distribution sites for assessments or incident response.
• Participates in an on-call rotation and may work outside normal hours during incidents or maintenance windows.
• Must pass a background check due to access to sensitive systems and payment environments.

#LI-DNI