Sr. Engineer, Cyber Security

Job Description

Job Description

Overview: Holley Performance Brands, founded in 1903, is a leading designer, manufacturer, and marketer of high-performance automotive aftermarket products. Our portfolio of iconic brands powers enthusiasts and racers worldwide—from classic muscle and modern performance to off-road and powersports—combining a rich heritage of innovation with a passion for performance.The Senior Cybersecurity Engineer is responsible for defining, implementing, and continuously improving the security posture of Holley’s technology environment. This role ensures that security is embedded into how we design, build, and operate systems across infrastructure, applications, and cloud platforms.This individual acts as both a technical expert and a strategic partner, working across IT, business teams, and external partners to proactively identify risk, implement effective controls, and enable secure growth. A key focus of this role is supporting regulatory and compliance initiatives, while ensuring security practices are practical, scalable, and aligned to business objectives.The primary objective: reduce risk, improve resilience, and ensure security is an enabler—not a blocker—to the business.

Key Responsibilities: Security Architecture & Engineering

• Design and implement security solutions across network, infrastructure, endpoints, identity, and cloud environments.
• Define and enforce security standards, patterns, and best practices across IT.
• Embed security into system design, application development, and integration efforts (“secure by design”).
• Partner with all IT Teams to ensure new solutions meet security requirements from the outset.
• Evaluate emerging technologies and recommend improvements to strengthen overall security posture.

Threat Detection, Response & Resilience

• Lead advanced threat detection and response efforts across the environment.
• Own and continuously improve incident response processes, including playbooks, escalation paths, and post-incident reviews.
• Conduct root cause analysis and ensure corrective actions are implemented and sustained.
• Simulate and test response readiness (e.g., tabletop exercises, incident scenarios).
• Drive improvements in detection coverage, response time, and overall resilience.

Vulnerability & Risk Management

• Establish and maintain a risk-based vulnerability management program.
• Prioritize vulnerabilities based on business impact and threat exposure—not just severity scores.
• Partner with IT teams to drive timely remediation and reduce risk exposure.
• Track and report on risk posture, remediation progress, and outstanding gaps.
• Proactively identify systemic risks and drive long-term fixes.

Identity, Access & Data Protection

• Partner with the IAM Engineer to strengthen identity and access management practices across the organization.
• Support implementation of least privilege access, role-based access controls, and privileged access management.
• Assist in the rollout and governance of identity platforms.
• Ensure identity-related controls are integrated into broader security architecture and operations.
• Help drive adoption of IAM best practices across IT and business teams.

Security Operations & Tool Optimization

• Own and optimize core security tooling (SIEM, EDR, vulnerability scanners, email security, network security tools).
• Ensure effective logging, monitoring, and alerting across all environments.
• Drive automation and integration across tools to improve efficiency and response times.
• Continuously assess tool effectiveness—reduce noise and improve signal.

Managed Services & Vendor Partnership

• Partner closely with the managed security services provider (MSSP) to ensure effective monitoring, detection, and response.
• Establish clear accountability, service expectations, and performance metrics with the vendor.
• Continuously evaluate vendor performance and drive improvements where needed.
• Ensure seamless coordination between internal IT teams and external partners—no gaps, no duplication, no finger-pointing.
• Act as the internal owner of the relationship, ensuring services align with Holley’s security priorities and risk posture.

Compliance, Governance & Audit Support

• Lead and support cybersecurity compliance efforts, including TISAX, SOX, and other applicable frameworks.
• Translate compliance requirements into practical, enforceable controls.
• Partner with audit and risk teams to prepare for and complete audits successfully.
• Maintain documentation of controls, processes, and evidence.
• Ensure ongoing adherence—not just point-in-time compliance.

Cross-Functional Collaboration & Enablement

• Act as a trusted advisor across the entirety of IT
• Ensure security is fully integrated into IT processes, not operating as a siloed function.
• Enable teams to make secure decisions without slowing down delivery.
• Serve as the escalation point for complex security challenges.
• Promote a culture of shared ownership for security across IT.

Continuous Improvement & Security Maturity

• Drive initiatives to improve overall cybersecurity maturity.
• Identify gaps in current capabilities and develop plans to address them.
• Stay current on emerging threats, vulnerabilities, and industry trends.
• Contribute to building a security-first culture across the organization.

Qualifications:

• 8–12+ years of experience in cybersecurity, with strong hands-on engineering expertise.
• Experience working with managed security service providers (MSSPs) or external security vendors.