Security Operations Engineer

Security Operations Engineer

The Security Operations Engineer is responsible for executing and operating enterprise cybersecurity functions across Richline Group subsidiaries. Reporting to the Senior Cybersecurity Analyst / Cybersecurity Lead, this role focuses on vulnerability management, patch coordination, security monitoring, endpoint security, and incident response execution. The position supports a unified cybersecurity stack and works corporately across locations, with a strong emphasis on Microsoft Windows enterprise environments.

Vulnerability & Patch Management

• Operate enterprise vulnerability scanning and patch management platforms.
• Support risk-based patch schedules, remediation priorities, and vulnerability service-level targets across subsidiaries.
• Coordinate remediation activities with Network, Systems, and Endpoint Administrators.
• Track remediation progress, validate closure, and produce vulnerability and patch compliance reporting.
• Support vulnerability exception handling in coordination with GRC and cybersecurity leadership.

Security Monitoring, EDR & Alert Triage

• Monitor and investigate security alerts from SIEM, MDR, EDR/XDR, IDS/IPS, cloud security, and related enterprise security technologies.
• Perform first-level investigation and triage, identify false positives, document findings, and escalate validated issues when additional action is required.
• Perform day-to-day operational tasks within enterprise endpoint detection and response platforms, including alert review, endpoint investigation, containment support, and policy-related administration under approved standards.
• Support tuning and continuous improvement of security monitoring and detection capabilities.

Incident Response Execution

• Execute incident response activities such as evidence collection, endpoint isolation, containment, remediation support, and documentation.
• Maintain incident timelines, investigation notes, and supporting evidence.
• Support post-incident reviews and corrective action tracking.

Cloud, Web & Internet-Facing Security

• Support the operation and monitoring of cloud and internet-facing security controls, including web application firewalls (WAF), bot management and detection, application and API protection, traffic filtering, and related threat-prevention technologies.
• Assist with investigation of suspicious web, application, and cloud activity and coordinate remediation or escalation as required.
• Support security controls across cloud-based and hybrid enterprise environments.

Security Tool Operations & Automation

• Perform day-to-day operational management of cybersecurity tools under approved designs, policies, and standards.
• Support SOAR playbook execution, workflow automation, and operational security process improvements.
• Maintain documentation, operational procedures, and technical runbooks for assigned security technologies.

Collaboration & Reporting

• Work closely with IT Operations, GRC, application teams, and external security providers to coordinate security activities and remediation.
• Provide operational metrics, findings, and status reporting to cybersecurity leadership.
• Participate in security reviews, incident exercises, and continuous improvement initiatives.

What You'll Need

• 3-5 years of hands-on experience in security operations, infrastructure security, SOC operations, or a related cybersecurity role.
• Strong working knowledge of enterprise Microsoft Windows environments, including Windows endpoints, Windows Server, Active Directory, patching, authentication, and security hardening concepts.
• Hands-on experience working with enterprise EDR/XDR platforms, including alert investigation, endpoint activity review, containment, and remediation support.
• Experience with vulnerability management and enterprise patch management, including vulnerability review, risk-based prioritization, remediation tracking, and validation.
• Experience with SIEM and security monitoring platforms, including alert triage, log analysis, investigation, documentation, and escalation.
• Working knowledge of incident response processes and security investigation practices.
• General understanding of cloud and internet-facing security controls such as WAF, application protection, bot protection, API security, and cloud security technologies.
• Strong analytical, troubleshooting, documentation, and communication skills.

Preferred

• Experience with proactive threat hunting using EDR/XDR technologies and endpoint telemetry is highly desirable.
• Experience administering enterprise email security platforms and related modules, including phishing and malware protection, URL and attachment analysis, data loss prevention, and cloud/SaaS security capabilities, is a plus but not required.
• Experience with SOAR, security automation, or playbook development is a plus.
• Experience supporting security in Microsoft cloud or hybrid environments is preferred.
• Experience with network security technologies such as firewalls, IDS/IPS, DNS/web security, segmentation, or network traffic analysis is beneficial.

Education & Certifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical field preferred, but not required.
• Relevant cybersecurity, information technology, or security operations training is preferred.
• Industry-recognized cybersecurity certifications such as CompTIA Security+, CySA+, SSCP, GSEC, or equivalent are preferred.
• Specialized training or certifications in endpoint security/EDR, SIEM, vulnerability management, incident response, Microsoft security technologies, cloud security, or threat hunting are a plus.
• Relevant hands-on experience and technical training may be considered in evaluating a candidate's overall qualifications.

Role Scope

• This is an individual-contributor role and does not include direct people-management responsibilities.
• The role executes and operates cybersecurity controls but does not independently own enterprise security architecture decisions.
• The role works in partnership with IT Operations and does not replace IT Operations leadership or infrastructure ownership.

Reporting & Collaboration

• Reports to the Senior Cybersecurity Analyst / Cybersecurity Lead.
• Works closely with IT Operations, GRC, application teams, and managed security service providers.
• Escalates complex investigations, major incidents, and security architecture decisions to senior cybersecurity leadership as appropriate.

Location

• New Mexico or Florida-Hybrid

Salary

• $75,000-85,000 Annually