Sr. CyberSecurity Engineer

100% Remote: Preferred locations: Columbus, OH, Cincinnati, OH, Richmond, VA or Dallas, TX. EST OR CST required.

Think Consulting is a national technology and operations consulting firm partnering with organizations to build the people, process, and technical capability behind their growth. We've been engaged by Our Client - a fast-scaling, multi-operating-company enterprise - to identify a Senior Cyber Security Engineer who can build a real engineering bench around a maturing security program.

Why This Role Exists

Our Client is scaling its technology estate faster than its security controls were originally built to carry - ERP consolidation in flight, a new enterprise data platform, AI assistants rolling out, and a growing footprint of field-service and operational technology (OT) systems across multiple business units. Security today is delivered through a mix of cloud-native tooling, a managed detection provider, and fractional/vCISO oversight. What's missing is a deep, hands‑on engineering bench that owns the controls end to end. The Senior Cyber Security Engineer is the senior technical practitioner in that function - the person who designs, builds, and operates Our Client's preventive and detective controls across identity, endpoint, email, cloud, network, and data protection; hardens new environments as the business stands them up; leads incident response on the technical side; and turns audit and insurance requirements into implemented configuration rather than documented intent. This is a builder's role in a high-velocity environment. New business units and acquisitions arrive with their own tenants, tooling, and gaps. Success here is measured in controls that are deployed, monitored, and evidenced - not in policy binders or dashboards nobody acts on.

What You'll Own

Security Architecture & Engineering

• Design and implement technical security architecture across identity, endpoint, email, network, cloud, and data - translating strategy into deployed, tested configuration.
• Serve as security engineering's design authority on major programs: ERP consolidation, enterprise data platform buildout, AI assistant deployment, CRM selection, and integration platform work.
• Build and maintain hardening standards and secure baselines for Windows, Linux, mobile, and cloud workloads - enforced through configuration management, not manual review.
• Define the secure-by-default reference patterns other IT teams build against: network segmentation, secrets management, logging, and third-party connectivity.
• Lead security engineering for acquisition integrations: assess the acquired estate, prioritize remediation, and bring new tenants and endpoints onto company standards.

Threat Detection & Response

• Own the technical relationship with the managed detection and response (MDR) provider - tuning detections, closing coverage gaps, validating alert quality, and holding the provider to response SLAs.
• Engineer detection content and log pipelines across a modern SIEM/XDR stack, including data source onboarding, analytics rules, and automated response playbooks.
• Act as technical incident commander during security incidents: containment, forensics, eradication, recovery, and post-incident review with tracked corrective actions.
• Run purple-team and tabletop exercises against realistic scenarios - ransomware, business email compromise, vendor compromise, OT disruption - and convert findings into engineering work.
• Own and continuously improve incident response runbooks, escalation paths, and evidence-handling procedures.

Identity & Access

• Engineer and operate the identity security stack - conditional access, MFA and phishing-resistant authentication, privileged identity management, and joiner-mover-leaver lifecycle automation.
• Drive least-privilege across cloud and on-prem: privileged access workstations, just-in-time elevation, service account governance, and periodic access recertification.
• Secure machine and workload identity for integrations, APIs, and automation, including secrets management and credential rotation.
• Partner with application teams so role design in ERP, CRM, and field-service platforms is enforceable and segregation-of-duties conflicts are caught before go-live.

Vulnerability & Risk Management

• Own the vulnerability management program end to end - discovery, prioritization by exploitability and business exposure, remediation tracking, and SLA reporting.
• Run internal and third-party penetration testing and red-team engagements, driving findings to closure with accountable technical owners.
• Maintain an accurate asset inventory across endpoints, servers, cloud resources, SaaS, and field devices.
• Assess and monitor third-party and supply chain risk for critical vendors, and set security requirements built into vendor selection and contracts.
• Quantify and report residual risk to leadership in terms of business impact, not raw finding counts.

Compliance, OT & Cross-Functional Partnership

• Translate cyber insurance, customer, and contractual security requirements into implemented controls with audit-ready evidence.
• Support attestation and assessment work against recognized frameworks (e.g., NIST CSF, CIS Controls) as the technical subject matter expert.
• Extend appropriate controls into OT and field-service environments - facilities systems, shop floor, fleet telematics, connected field devices - with segmentation and monitoring suited to availability-sensitive systems.
• Partner with AI/data teams on securing assistant and model use: data exposure controls, prompt and output handling, and guardrails against shadow AI.
• Deliver security awareness and phishing simulation content that changes behavior, and coach IT and business unit staff on secure practice.

Technical Environment

• Identity: Modern cloud identity platform - conditional access, MFA, PIM, identity protection
• Endpoint & Email: Enterprise EDR/XDR and email security suite
• Detection & Response: Cloud-native SIEM and XDR; 24x7 managed detection and response partner
• Cloud & Infrastructure: Major public cloud platform; hybrid Windows and Linux estate
• Data & AI Governance: Enterprise data governance platform - DLP, sensitivity labeling, model and prompt governance
• Data Platform: Modern cloud data lakehouse/warehouse platform
• Vulnerability Management: Enterprise vulnerability scanning, attack surface management, penetration testing partners
• Network: Firewall, secure edge and remote access, segmentation across business unit sites
• Business Systems: ERP, financial, and integration platforms across multiple business units
• Field Service & OT: Field-service systems, fleet telematics, and connected field devices

Candidates with deep Microsoft security-stack experience (Entra ID, Defender XDR, Sentinel, Purview) will be especially well-matched, but the core requirement is enterprise-grade security engineering depth - not a specific vendor stack.

What You Bring

Required:

• Bachelor's degree in computer science, information systems, cybersecurity, or equivalent practical experience.
• 7+ years in information security, with at least 3 in a hands-on security engineering role owning production controls.
• Deep, current expertise with a modern cloud security stack (identity, XDR, SIEM, data governance) - configuration, tuning, and troubleshooting at enterprise scale.
• Demonstrated incident response experience as a technical lead, from detection through containment, eradication, and post-incident review.
• Strong foundation in identity and access engineering: conditional access design, privileged access management, least-privilege enforcement.
• Practical experience running a vulnerability management program with measured remediation against defined SLAs.
• Working knowledge of a recognized control framework (NIST CSF, CIS Controls) and experience producing audit-grade evidence.
• Scripting and automation capability (PowerShell, Python, or equivalent) applied to security operations at scale.
• Ability to explain technical risk and remediation trade-offs clearly to IT leadership and non-technical executives.

Preferred:

• Industry certification: CISSP, GCIH, GCIA, GPEN, OSCP, or Microsoft security certifications.
• Experience securing multi-tenant or multi-business-unit environments and integrating acquisitions onto a common security standard.
• Experience in construction, specialty contracting, manufacturing, distribution, or field services, including OT/ICS exposure.
• Experience securing enterprise AI deployments - assistant governance, data exposure controls, model/prompt risk.
• Cloud security depth in Azure or AWS, including posture management, workload protection, and infrastructure-as-code review.
• Experience managing an MDR/SOC provider relationship to measurable outcomes.
• Familiarity with cyber insurance underwriting requirements and customer security questionnaire processes.

How We'll Measure Success in Year One

• Secure baselines defined and enforced across endpoints, servers, and cloud workloads, with measured configuration compliance rather than sampled review.
• Conditional access and phishing-resistant MFA fully deployed enterprise-wide, with privileged access under just-in-time control.
• Detection coverage mapped to a recognized threat framework, priority log sources onboarded, alert quality measurably improved.
• Vulnerability remediation operating to defined SLAs, with critical/high findings trending down quarter over quarter.
• Incident response plan tested through at least two exercises, with corrective actions tracked to closure.
• Security engineering requirements embedded as a standard gate in ERP, data platform, and AI program delivery.
• Acquisition security integration playbook published and applied to at least one business unit onboarding.
• Cyber insurance and customer security requirements satisfied with evidence produced from operating systems, not assembled by hand.

Who Thrives in This Role

• A hands-on engineer first - builds and operates controls rather than delegating them to documents.
• A risk-based prioritizer - distinguishes what's exploitable and material from what's merely reportable.
• Calm and decisive under incident pressure, with disciplined communication to leadership.
• Enables the business securely instead of defaulting to no - finds the controlled path to yes.
• Automates repeat work and measures control effectiveness continuously.
• Collaborative across IT pillars - infrastructure, applications, data, integration, and AI.
• Intellectually current on the threat landscape without chasing tooling for its own sake.

This role suits a senior security engineer who wants ownership of a real controls environment during a period of rapid growth - not a governance seat, a builder's seat.

Equal Opportunity Employer, including disability and protected veteran status