Security Engineer

Job Description

InfoSec Engineer

\n

\n

Responsibilities

\n

Compliance & Governance

\n

\n
• Lead clients through SOC 2 and ISO 27001 audits, from readiness assessment and remediation through evidence collection and auditor coordination
\n
• Manage the firm’s internal compliance program using Vanta
\n
• Develop compliance roadmaps tied to client growth stages, fundraising, and IPO preparation
\n
• Write and maintain security policies (incident response, access control, acceptable use, AI usage, BCDR, WISP) aligned with NIST, SEC Reg S-P, GDPR, and CCPA
\n

\n

Vendor Risk & Client Assurance

\n

\n
• Build and maintain client Trust Centers and complete security questionnaires (SIG, CAIQ, RFPs)
\n
• Assess new vendors and AI tools and advise clients on adoption
\n
• Maintain vendor inventories, risk tiers, and attestations, and refine the TPRM process
\n

\n

Security Engineering

\n

\n
• Deploy and manage EDR (SentinelOne) and MDM (Jamf, Mosyle, Intune) across Mac and Windows environments
\n
• Strengthen identity and access controls with Okta, MFA, and 1Password
\n
• Secure Google Workspace, Microsoft 365, and other SaaS and cloud platforms
\n

\n

Security Operations

\n

\n
• Triage alerts across endpoint, identity, email, and cloud, and lead incident response and post incident reviews
\n
• Own vulnerability management and pen test remediation
\n
• Maintain logging and SIEM sources, and run access reviews and configuration audits
\n
• Run security awareness training and phishing simulations (KnowBe4, Adaptive)
\n

\n

\n

Requirements

\n

\n
• 3 to 5+ years in information security or IT, including 2+ years of hands-on compliance work
\n
• Experience taking a company through a full audit using Vanta, Drata, or Secureframe
\n
• Hands-on EDR and MDM administration
\n
• Okta or Entra ID experience
\n
• Google Workspace or Microsoft 365 security, plus experience with a major cloud platform
\n
• Vulnerability management and incident response experience
\n
• Solid grasp of SOC 2, ISO 27001, and NIST CSF, with the ability to write audit-ready policies
\n

\n

\n

Nice to Have

\n

\n
• Security+, CISSP, CISA, or ISO 27001 Lead Implementer
\n
• MSP or consulting background
\n
• SEC Reg S-P, SOX ITGC, or IPO readiness experience
\n
• AI tool risk assessments
\n
• Python, PowerShell, or Bash scripting
\n