Cyber Security Engineer

Job Description

Job Title: IT/ Cybersecurity Engineer

Location (on site vs remote): Onsite 5 days

Duration: 6-12 Month Contract to Hire

Address: 110 Algonquin Pkwy, Whippany, NJ 07981

Company background: They manufacture aerospace/defense actuation systems and serve commercial and military applications. They have a small local IT team supporting the one-site environment.

\n
• Role: Blended IT + Cybersecurity resource, not a pure cybersecurity role. They need someone who can support cybersecurity while also helping with backend IT/infrastructure and some user-facing support.
\n
• Experience: Open to ~3 years for the right hands-on candidate, but would prefer 5–7 years of experience.
\n
• Cybersecurity: CMMC Level 2 experience . They work with secure government-related information that needs to remain protected/separated. US citizen/person required.
\n
• IT responsibilities: Server/backend maintenance, upgrades, software updates, user-facing support, ID/access issues, printers, VPN, and general IT maintenance. CAT/CAC badge project is also part of the environment.
\n
• Environment: Small local IT team of 2, one site/one building. Most employees are onsite or work through VPN. Syteline is their ERP.
\n
• Candidate profile: They want someone proactive, hands-on and willing to learn the environment , rather than someone who is just waiting for tickets. They specifically want someone who brings a stronger sense of urgency and ownership.
\n
• Flexibility: If the cybersecurity workload is lighter at times, they would like someone who can step into a second hat and support broader IT needs.
\n

Position Summary

The Information Security Lead is a dedicated, hands-on cybersecurity professional responsible for helping build, operate, and continuously improve the company’s internal security program.

The role works across security operations, identity and access management, endpoint and network defense, vulnerability management, vendor risk, compliance, incident response, business continuity, and user enablement. Working closely with Information Technology, engineering, operations, and business teams, the Information Security Lead protects company systems and regulated information while supporting efficient business operations.

This role is intended for a professional with broad information technology and security experience who can operate independently, coordinate across teams, and grow into a senior internal security role.

Responsibilities

Support day-to-day security operations, including alert triage in SIEM and EDR platforms, log review, threat monitoring, investigation, containment, escalation, and incident-response activities.

Administer identity and access management controls, including SSO, MFA, Active Directory and Microsoft Entra ID, privileged access, and joiner, mover, and leaver processes; conduct periodic access reviews and remove stale accounts and unnecessary entitlements.

Maintain and improve endpoint security across the company’s technology environment, including EDR health, patch management, configuration baselines, software control, disk encryption, and remediation of exceptions.

Perform and coordinate network security activities, including firewall and access-control-list reviews, VPN administration, segmentation, secure configuration, wireless security, and monitoring for misconfigurations and unauthorized activity.

Operate the vulnerability management program by performing or coordinating scans, prioritizing vulnerabilities based on business risk and exposure, assigning remediation to system owners, validating closure, and reporting trends and metrics.

Support cybersecurity incident response, disaster recovery, and business continuity planning, including exercises and testing designed to restore critical business systems within established recovery objectives.

Support compliance with applicable customer, contractual, and regulatory requirements, including CMMC, DFARS, ITAR and other U.S. export controls, and, where applicable, NIS2, Cyber Essentials, Cyber Essentials Plus, CMS, DCPP, ISO/IEC 27001, GDPR, and customer-specific information-security requirements.

Collect and maintain audit evidence; develop and maintain policies, procedures, system security plans, plans of action and milestones, risk registers, data-flow diagrams, network diagrams, control documentation, and recurring compliance records; support customer questionnaires and internal and external audits.

Support third-party and supplier risk management by reviewing security documentation, assessing risks, tracking remediation and risk acceptances, and monitoring relevant service-provider controls.

Develop and deliver security awareness and role-based training, phishing simulations, onboarding content, and practical guidance on reporting suspicious activity, protecting CUI and FCI, and responding to security events.

Serve as a knowledgeable point of contact for employee security questions, suspicious emails, lost devices, access requests, and other security concerns.

Research, recommend, implement, and document security technologies, standards, configuration baselines, processes, and runbooks so the security program scales with the company.

Coordinate effectively with internal teams, external service providers, assessors, and other stakeholders, and participate in an on-call rotation when needed.

Perform other tasks as assigned.

Required Education and Experience

\n
• Bachelor’s degree in cybersecurity, information systems, computer science, or a related discipline, or an equivalent combination of education and relevant experience.
\n
• At least three years of experience in information security, information technology operations, or a closely related field, with hands-on exposure to multiple security domains.
\n
• Working knowledge of SIEM, EDR, vulnerability scanning, identity providers, cloud platforms, and security tools such as CrowdStrike Falcon, Tanium, ThreatLocker, Microsoft Entra ID, or equivalent technologies.
\n
• Strong fundamentals in networking, Windows operating systems, Active Directory, Microsoft 365, authentication protocols, endpoint management, firewalls, VPNs, and secure system configuration.
\n
• Practical knowledge of CMMC requirements and the protection of Controlled Unclassified Information and Federal Contract Information; familiarity with DFARS, ITAR, export-control obligations, NIST guidance, and ISO/IEC 27001 or comparable security frameworks.
\n
• Strong written and verbal communication skills, including the ability to explain security risks and requirements to non-technical audiences and produce clear policies, procedures, audit evidence, and management reporting.
\n
• Ability to work independently, manage competing priorities, coordinate across departments, and use sound judgment in a fast-moving environment.
\n
• Industry certification such as CISSP, CISM, CISA, CRISC, CCIE, CCNP Security, CompTIA Security+, Network+, or a comparable credential, or the ability to obtain an agreed certification within a defined period.
\n
• Willingness to participate in an on-call rotation and support systems outside normal business hours when necessary.
\n
• Because this position requires access to U.S. export-controlled hardware, technical data, software, or information, employment is contingent on the individual being legally eligible for the required access under applicable U.S. export-control laws and company procedures. Any required authorization or license must be in place before controlled access is granted.
\n
• Legal authorization to work in the United States is required. The company will not sponsor employment visas now or in the future for this position.
\n

Preferred Qualifications

\n
• Experience supporting or leading internal, customer, regulatory, or certification audits and managing remediation through closure.
\n
• Experience in a defense, aerospace, manufacturing, or other regulated environment that handles CUI, FCI, or export-controlled information.
\n
• Experience with cloud security posture management and Microsoft GCC High or other regulated cloud environments.
\n
• Familiarity with offensive security concepts, penetration-test findings, attack-path analysis, and related tooling.
\n
• Experience developing and testing incident-response, ransomware-recovery, disaster-recovery, and business-continuity plans.
\n
• Experience coordinating managed security service providers, security consultants, assessors, and third-party review partners.
\n

Physical Requirements

\n
• Some lifting of computer equipment is required for diagnosis, setup, and installation.
\n
• Frequently positions self to maintain computers in the lab, including under the desks and in the server room.
\n
• Ability to operate office equipment including computers and determine accuracy of work.
\n
• While performing the duties of this job, the employee is regularly required to remain in a stationary position for a significant period and maneuver around the facility as needed.
\n
• Manual dexterity, which allows the individual to use hands to type on a keyboard, use a mouse and write are required.
\n
• Specific vision abilities required by this job include close vision.
\n
• Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.
\n