Information Security Engineer

Information Security Engineer

Formed in 1934, Telhio began as a credit union for Columbus Telephone Company (now AT&T) employees. Telhio now serves over 70,000 member-owners throughout central and southwest Ohio. As one of the largest credit unions in Ohio, Telhio is a strong financial institution that continues to serve its members through extraordinary service, innovative financial solutions and community involvement. After generations of service and growth, we never lose focus of our three core values - Caring, Commitment, and Integrity.

Position Summary

The Information Security Engineer is responsible for the design, implementation, and operational maintenance of technical security controls that protect the financial institution's information systems, infrastructure, and data. This role focuses on preventive, detective, and responsive security capabilities, ensuring systems are resilient, compliant, and aligned with regulatory expectations applicable to financial institutions. The Information Security Engineer partners closely with IT Operations, Infrastructure, Cloud, and Application teams to embed security into day-to-day operations while maintaining clear accountability and audit readiness.

Primary Responsibilities

• Security Engineering & Operations
• Design, implement, and maintain security controls across network, endpoint, server, cloud, and identity platforms.
• Configure, tune, and support security tools including (but not limited to):
• Endpoint Detection and Response (EDR/XDR)
• Network security controls (firewalls, segmentation, IDS/IPS)
• Identity and Access Management (IAM), MFA, and privileged access controls
• Vulnerability management and configuration hardening tools
• Ensure secure baseline configurations for operating systems, infrastructure, and cloud services.
• Monitor security alerts, investigate suspicious activity, and support incident containment and remediation efforts.
• Vulnerability & Threat Management
• Perform regular vulnerability scanning and analysis across infrastructure and applications.
• Work with IT teams to prioritize remediation based on risk, exposure, and business impact.
• Track remediation progress and validate corrective actions.
• Assist with threat modeling and identification of emerging risks relevant to financial services.
• Incident Response & Resilience
• Participate in security incident response activities, including detection, investigation, containment, and recovery.
• Support development and testing of incident response playbooks (e.g., ransomware, privileged account compromise, third-party incidents).
• Assist with forensic data collection and evidence preservation as required.
• Contribute to tabletop exercises and after-action reviews.
• Governance, Risk & Compliance Support
• Support security control evidence collection for audits, exams, and risk assessments.
• Assist in maintaining alignment with applicable regulatory and industry expectations (e.g., NCUA, GLBA, NIST).
• Document technical controls, configurations, and operational procedures in an audit-ready manner.
• Provide technical input into risk assessments, vendor reviews, and exception requests.
• Collaboration & Advisory
• Serve as a security engineering subject-matter expert for IT projects and infrastructure changes.
• Review system designs and architecture for security risks and control gaps.
• Partner with IT Operations to balance security, availability, and operational efficiency.
• Provide guidance on secure implementation without acting as a blocking function.

Required Qualifications

• Bachelor's degree in Information Security, Computer Science, Information Technology, or equivalent experience.
• 3–7 years of experience in information security engineering, infrastructure security, or related roles.
• Hands-on experience securing:
• Windows and/or Linux server environments
• Network infrastructure and firewalls
• Identity systems and privileged access
• Strong understanding of cybersecurity principles including least privilege, defense-in-depth, and zero trust concepts.
• Ability to document technical controls clearly for audit and executive audiences.

Preferred Qualifications

• Experience in a financial institution or highly regulated environment.
• Familiarity with NIST Cybersecurity Framework, CIS Controls, or similar standards.
• Experience with cloud security (Azure, AWS, or equivalent).
• Security certifications such as CISSP, CISM, GIAC, Security+, or vendor-specific credentials.
• Experience supporting security tooling such as SIEM, PAM, vulnerability scanners, or EDR platforms.

Key Competencies

• Strong analytical and problem-solving skills
• Attention to detail and operational discipline
• Ability to work effectively during incidents and time-sensitive events
• Clear written and verbal communication skills
• Professional judgment in balancing risk, usability, and business needs

Working Conditions

• Participation in incident response activities, including after-hours support as required.
• Access to sensitive systems and confidential information subject to background checks and ongoing compliance requirements.

Position Objective

This role exists to reduce cyber and operational risk by ensuring security controls are properly engineered, maintained, and continuously improved—supporting the institution's mission, regulatory obligations, and trust with members/customers.

What You Will Earn

• Competitive pay
• Benefits: medical, dental, vision, life and disability insurance
• 6% matching and immediately vested 401(k) plan
• Paid holidays, vacation and personal time
• Opportunity for personal career growth, continued education and mentorship programs
• Volunteer opportunities impacting the local community

Physical Demands

• While performing the duties of this job, you will need to have good manual dexterity as well as speaking and hearing ability. This position requires sitting; some reaching; standing; some stooping or kneeling. The employee must occasionally lift and move up to 50 pounds. It is expected that the employee will read, compile, compute and record numerical and statistical data. Must drive occasionally.