IT Security Specialist

Security Leader

Step2 is looking for a security leader who thinks big picture and is also an expert at the keyboard. You will set security strategy, stay ahead of fast-changing threats (especially new attack methods and vulnerabilities that come with AI), and do the hands-on work to protect our users, systems, data and sites. You will own our security program end to end: strategy, tools, vendors, training and incident response. We want someone excited by the challenge of protecting Step2 as AI makes attacks faster, cheaper and harder to spot: someone who questions whether yesterday's tools still fit, learns fast, and designs new defenses where needed. This is not a role for someone looking to re-implement a familiar legacy stack.

Job Duties:

• Strategy and threat intelligence: Track emerging threats, including AI-enabled phishing, deepfake and social-engineering attacks, prompt injection, data leakage through AI tools, and vulnerabilities in AI agents and integrations. Turn that into a security and business continuity strategy, with a tactical roadmap that stays current, and brief leadership on risk. The goal: no malware or device loss can take Step2 down.
• AI security: Set guardrails for how employees and systems use AI tools, agents and MCP connections. Review new AI tools and vendors for data exposure and access risk.
• Incident response and risk: Own the incident response plan, playbooks and courses of action. Run tabletop exercises, lead response when incidents happen, and maintain a risk register with mitigation plans.
• Business continuity: Build and test the continuity plan so malware, ransomware or device loss cannot stop the business. Includes fast device rebuilds, recovery of OneDrive and Microsoft 365 data (versioning, retention and backup), and regular recovery drills.
• Hands-on security operations: Set and verify security controls: MFA, conditional access and privileged accounts in Entra ID; Microsoft 365 security settings; vulnerability management; firewall, VPN and segmentation rules, including plant networks; access reviews for employees and contractors. The Senior Manager, IT Infrastructure & Operations administers these platforms; this role defines and checks the controls.
• Endpoint security and disposable devices: Own the security strategy for employee laptops and mobile devices. Treat every device as disposable: work lives in OneDrive and Microsoft 365, so any device can be wiped and replaced without losing data. Run remote scans, keep a live device and software inventory, find installed threats and unapproved software, remove malware, and isolate or wipe compromised devices remotely.
• Secure development (DevSecOps): Work with the software development team to design and enable CI/CD pipelines that include static (SAST) and dynamic (DAST) code analysis, plus dependency and secrets scanning. Cover industry-standard vulnerability classes such as the OWASP Top 10 and CWE Top 25, and help developers fix findings.
• Vendors and tools: Select, implement and manage security vendors and monitoring tools (EDR, SIEM/MDR, email security, vulnerability scanning). Manage contracts, performance and budget.
• Security telemetry and reporting: Consolidate security telemetry and logs into Snowflake for analysis. Build dashboards and alerting (e.g. Grafana) that show risk, trends and program performance.
• Third-party risk: Evaluate existing, proposed and new vendors against Step2's security compliance thresholds before and after onboarding. Apply the right access controls to each vendor (least privilege, time-limited access, MFA) and reassess them on a regular schedule.
• Policy and compliance: Keep security policies and standards current. Support audits, cyber insurance requirements and customer or retailer security questionnaires.
• Security awareness program: Take over and run our KnowBe4 employee training and phishing simulation program. Measure results, tailor content to our real threats and roles, and recommend how the program should evolve.
• Physical site security: Own building access control (badges, door systems, visitor access), security monitoring and CCTV across Step2 sites. Manage the related systems and vendors, review access rights, and bring physical security events into incident response and telemetry.

Basic Qualification Requirements:

• A forward-looking mindset: you can show how you have adapted defenses to new threats, and you evaluate modern and AI-driven security tools on their merits rather than defaulting to what you used before.
• 7+ years in IT security, with both strategic and hands-on technical responsibility.
• Proven record of taking initiative: building or substantially improving a security program, not just maintaining one.
• Current knowledge of AI-related threats and controls, and a habit of keeping up with the threat landscape.
• Deep hands-on skill with Microsoft 365 security, Entra ID, EDR, SIEM or log tools, vulnerability scanning, firewalls and VPN.
• Comprehensive experience with modern endpoint security strategy and management (e.g. Microsoft Intune and Defender for Endpoint): remote scanning, device and software inventory, threat and malware detection and removal, remote isolation and wipe. This is security-focused endpoint work, not general infrastructure.
• Experience running a security operations center (SOC), either internal or outsourced (MSSP/MDR), including setting escalation rules, SLAs and performance reviews. Experience selecting and managing security vendors.
• Experience writing and running incident response plans and tabletop exercises.
• Experience building and testing business continuity and ransomware recovery plans.
• Experience running a security awareness program (KnowBe4 or similar).
• Working knowledge of a security framework such as NIST CSF or CIS Controls.
• Clear communicator who can explain risk to leadership and train non-technical staff.
• Certifications preferred: CISSP, CISM, Security+, CySA+, or Microsoft SC-200/SC-300.

Additional Qualifications:

• Experience securing manufacturing or OT/plant networks.
• SQL and scripting (PowerShell, Python) to automate checks and analyze telemetry; Snowflake or Grafana experience.
• Experience with Oracle E-Business Suite or Snowflake access controls.
• AI security frameworks such as OWASP Top 10 for LLM Applications or NIST AI RMF.

Work Environment/Physical Demand:

Hybrid; based in Streetsboro, OH. Office, plant and warehouse environments, with travel between Step2 sites for physical security and incidents. Standard business hours, with flexibility to be reasonably available and respond quickly to critical outages or incidents that stop business operations, especially during peak selling seasons.

FLSA Status:

Exempt

What are the perks?

• Parental Leave
• 401k with Employer Match
• Company Paid Life & Disability Insurance
• Adoption Assistance
• Medical, Dental and Vision
• Premium FREE Medical Plan Option
• Employee Discount
• 10 Paid Holidays
• Advancement Opportunities

Join our family!

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, or national origin.