IT Security Engineer - Team Lead

Job Description

Role Overview

The IT Security Engineer – Team Lead will be instrumental in delivering security into the heart of Pibank software development lifecycle. Operating as the first line of defense, the IT Security Team Lead is a hands-on security generalist who operates and tunes the organization's security stack, manages security projects end to end, and guides a small team of security professionals. This role is the working lead of security operations, covering EDR, email security, vulnerability management, SIEM monitoring, and event investigations. The Team Lead keeps IT and InfoSec management informed with clear, concise reporting on security operations, incidents, and project status.

Key Responsibilities

Security Operations

• Administer, tune, and maintain EDR, email security, SIEM, vulnerability scanning, and related security tools
• Monitor and triage alerts, perform investigations, and contain and remediate security incidents
• Active participant during incident response activities, document findings, and drive root cause and lessons learned reviews
• Run the vulnerability management lifecycle, including scanning, risk-based prioritization, remediation tracking, and exception management
• Manage phishing defense, including email filtering, DMARC, DKIM, SPF, user reported phish triage, and simulation campaigns
• Work with the MSSP to conduct threat hunting and build detection rules aligned to MITRE ATT&CK
• Support identity and access security, including MFA, privileged access, and periodic access reviews
• Define and enforce Service Level Agreements (SLAs) for vulnerability remediation based on severity and risk.

Security Initiatives

• Work with the CISO to plan and execute security projects from scoping through delivery, including tool deployments, upgrades, and control improvements
• Manage project timelines, dependencies, and coordination with infrastructure, application, and business teams
• Partner with the CISO and VP – Information Technology to evaluate new security technologies and recommend improvements to the security stack
• Participate in incident response planning, tabletop exercises, and root cause analysis.
• Translate complex security vulnerabilities into tangible business risks and opportunities for improvement for non-technical stakeholders.

Team Leadership

• Guide and mentor a team of two to three security analysts
• Assign and prioritize daily work, review investigations, and serve as the escalation point
• Develop and maintain runbooks, procedures, and operational standards
• Support analyst growth through coaching, training, and certification goals

Reporting and Communication

• Report security metrics, incident summaries, and project status to VP – Information Technology and CISO
• Translate technical findings into clear business risk for leadership
• Support the CISO during internal audits, regulatory examinations, and third-party assessments with evidence and control walkthroughs
• Partner with IT teams to remediate findings and embed security into operations

Qualifications & Experience

• Bachelor’s degree in information technology, Cybersecurity, Computer Science, or equivalent experience
• 5+ years of hands-on cybersecurity experience, with deep focus on security technologies
• Direct administration experience with EDR or XDR platforms such as CrowdStrike, email security platforms such as Abnormal, vulnerability management systems such as Qualys or Rapid7, and managing MSSP partners.
• Proven experience managing incident investigations from detection through remediation
• Familiarity with Active Directory, Microsoft Entra ID, Microsoft 365, and Windows and Linux environments
• Experience leading projects or informally leading other analysts
• Strong written and verbal communication, with the ability to brief management on technical risk
• Familiarity with NIST CSF, CIS Controls, and MITRE ATT&CK
• Preferred experience in a regulated financial services environment supporting FFIEC, GLBA, SOX, or PCI DSS requirements or other highly regulated environment
• Scripting and automation skills in PowerShell or Python is valuable
• Exposure to Azure or AWS security, Zero Trust, and next generation firewalls
• One or more certifications such as Security+ or CySA+, or other security certifications

PiBank is an equal opportunity Employer