Security Engineer

InfoSec Engineer

For a complete understanding of this opportunity, and what will be required to be a successful applicant, read on.

Responsibilities

Compliance & Governance

• Lead clients through SOC 2 and ISO 27001 audits, from readiness assessment and remediation through evidence collection and auditor coordination
• Manage the firm’s internal compliance program using Vanta
• Develop compliance roadmaps tied to client growth stages, fundraising, and IPO preparation
• Write and maintain security policies (incident response, access control, acceptable use, AI usage, BCDR, WISP) aligned with NIST, SEC Reg S-P, GDPR, and CCPA

Vendor Risk & Client Assurance

• Build and maintain client Trust Centers and complete security questionnaires (SIG, CAIQ, RFPs)
• Assess new vendors and AI tools and advise clients on adoption
• Maintain vendor inventories, risk tiers, and attestations, and refine the TPRM process

Security Engineering

• Deploy and manage EDR (SentinelOne) and MDM (Jamf, Mosyle, Intune) across Mac and Windows environments
• Strengthen identity and access controls with Okta, MFA, and 1Password
• Secure Google Workspace, Microsoft 365, and other SaaS and cloud platforms

Security Operations

• Triage alerts across endpoint, identity, email, and cloud, and lead incident response and post incident reviews
• Own vulnerability management and pen test remediation
• Maintain logging and SIEM sources, and run access reviews and configuration audits
• Run security awareness training and phishing simulations (KnowBe4, Adaptive)

Requirements

• 3 to 5+ years in information security or IT, including 2+ years of hands-on compliance work
• Experience taking a company through a full audit using Vanta, Drata, or Secureframe
• Hands-on EDR and MDM administration
• Okta or Entra ID experience
• Google Workspace or Microsoft 365 security, plus experience with a major cloud platform
• Vulnerability management and incident response experience
• Solid grasp of SOC 2, ISO 27001, and NIST CSF, with the ability to write audit-ready policies

Nice to Have

• Security+, CISSP, CISA, or ISO 27001 Lead Implementer
• MSP or consulting background
• SEC Reg S-P, SOX ITGC, or IPO readiness experience
• AI tool risk assessments
• Python, PowerShell, or Bash scripting