Cyber Security Engineer

Thank you for stopping by to take a look at the Cyber Security Engineer role I posted here on LinkedIN. Allow me to introduce myself a bit. My name is Tom Welke. I am Partner & VP here at RSM Solutions, Inc. I am a real live, breathing, human writing this. So, no 'bots'....just a real person. The reason I mention this (and if you have read my JD's before you probably already know this) is that I realized - a long time ago - that looking for work is about as fun as a migraine...so, if I can make the process a little easer and even humorous, I will gladly do it. So, yep, you hopefully will have some chuckles as you read through this....along with, hopefully, more clarity in terms of what I am looking for as opposed to a zillion bullet points that - essentially - say nothing.

So, here are a few 'ground rules' before we go further:

• I am not working with external vendors or 3rd parties for this role. I get it, a lot of vendors are trying to share their 'ideal candidates'....please stop...
• The client for this role cannot provide immigration sponsorship now or in the future. As a result, I’m only able to work with candidates who have permanent authorization to work in the U.S. and will never require sponsorship (typically U.S. citizens or Green Card holders). With that in mind, I cannot consider candidates that require employer sponsorship at any point now or in the future (including under H1, EAD, STEM, OPT, or other time-limited work authorization). In addition, I can only work with candidates that reside in the US for this role.
• This role is permanent and remote. Our ideal is to have someone located in Indiana, Michigan, Illinois or Wisconsin.

As with just about every role I work on, social fit is really important. Here are a couple of the key social fit characteristics for this role:

• You will be working for a division of a larger holding company. The holding company has a team of 4 pretty senior Cyber Security Engineers (they will be involved in the interview process, interestingly enough). However, for the division you will be working with, you will be the only Cyber Security Engineer. So, that ability to work independently well will be needed for success in this role. Yep, you will be collaborating with these other 4 engineers quite a bit as well.
• This is an environment with limited egos and everyone shares their knowledge with one another. So, we are seeking individuals who enjoy sharing their knowledge with others, as opposed to looking at everything as 'my info' and 'their info'.

Here is what we are seeking for this role:

We are seeking a Cybersecurity Engineer that will perform two core functions. The first is the day-to-day operations of the in-place security solutions while the second is the identification, investigation, and resolution of security breaches detected by those systems. Secondary tasks may include involvement in the implementation of new security solutions, participation in the creation and or maintenance of policies, standards, baselines, guidelines, and procedures as well as conducting vulnerability audits and assessments. The IT Security Engineer is expected to be fully aware of the enterprise’s security goals as established by its stated policies, procedures, and guidelines and to actively work towards upholding those goals

In those first key 30, 60, and 90 days, here is what those expectations look like:

30 Days - You will be getting up to speed on the tools you will be working with. These guys have a pretty well defined training cycle to get up up to speed and fully on board. You will, by 30 days in, start administering those systems, and dig into KPIs.

60 Days - You will be mapping key vulnerabilities, and getting established with those key KPIs (if you have KPIs you have used with success in the past, feel free to share them).

90 days - You should, by this time, really start to own the tools you use and start taking ownership of key systems.

Here are some of the key responsibilities for this role (I like to narrow the typical zillion bullets into the real meat of what we are seeking):

• Maintain up-to-date detailed knowledge of the IT security industry including awareness of new or revised security solutions, improved security processes, and the development of new attacks and threat vectors.
• Participate in the creation of enterprise security documents (policies, standards, baselines, guidelines, and procedures) under the direction of the IT Security Manager, where appropriate.
• Perform the deployment, integration, and initial configuration of all new security solutions and of any enhancements to existing security solutions in accordance with standard best operating procedures generically and the enterprise’s security documents specifically.
• Maintain up-to-date baselines for the secure configuration and operations of all in-place devices, whether they be under direct control (i.e. security tools) or not (e.g. workstations, servers, network devices).
• Monitor all in-place security solutions for efficient and appropriate operations.
• Review logs and reports of all in-place devices, whether they be under direct control (i.e. security tools) or not (e.g. workstations, servers, network devices). Interpret the implications of that activity and devise plans for appropriate resolution.
• Design, build, and maintain security automation workflows to improve detection, response, vulnerability management, user access reviews, and compliance evidence collection.
• Develop scripts, playbooks, integrations and automated workflows using tools such as PowerShell, Python, APIs, SOAR platforms, SIEM automation, Microsoft Graph, and ITSM platforms.
• Automate repetitive security operations tasks including alert enrichment, case creation, containment actions, reporting, control validation, and exception tracking.

Here is what we are seeking:

• Extensive experience with security frameworks (e.g. ISO 27001/27002, NIST 800-53, NIST CSF etc.)
• We are looking for the individual who does not need to be 'told' what to do...rather, the person who knows what to do. This leads to something. We are seeking that individual who has created those Cyber Security Playbooks or had added to them, as opposed to the individual who just follows what has been written. This is a gotta have.
• At least 4-5 years of experience with EDR solutions - These guys are a heavy Microsoft Shop so, specific experience with the E5 stack (Microsoft Defender for Endpoint (MDE) is a gotta have.
• At least 3-4 years of Experience with Sentinel for SIEM is a gotta have.
• At least 3-4 years of experience with CrowdStrike Falcon is a gotta have.
• At least 3-4 years of experience with Azure (Entra ID)
• Experience with Pen testing tools such as Cobalt is a gotta have.
• This role is a mix of blue team and red team...so, we are seeking roughly as close to a 50% / 50% split between red team and blue team for this role. That mix of red team and blue team is a gotta have.
• Patching and IT Asset Management systems (ManageEngine Preferred)
• Security automation using PowerShell, Python, APIs, Microsoft Graph, SOAR, SIEM automation, or ITSM workflows.
• Security monitoring and governance for AI platforms and emerging technologies would be great to see (they use Abnormal Ai, so if you have experience with this tool, that would be a really great thing to see).
• Identity security, privileged access, MFA, SSO, and conditional access.
• MITRE ATT&CK and threat-informed detection engineering experience.