Security Engineer

Security Engineer — GRC, Cloud, Workspace & IdAM

This role runs programs that most organizations staff separately: governance and compliance, cloud, SaaS, Identity and Access Management security posture, and the assessment cycle that tests them all. It is an individual contributor role with program ownership. There are no direct reports, and nearly everything that needs to change is owned by someone else — a cloud engineer, an application owner, a business-unit administrator. The work is therefore split between doing (assessing, documenting, evidencing, configuring) and driving (getting findings closed by people who do not report here). The Director owns policy approval, budget, vendor contracts, and executive reporting. This role owns the programs running, the findings closing, and the evidence being ready before it is asked for.

Governance, Risk & Compliance

• Maintain the security policy and standards library — drafting, revision cycles, approvals, publication, and attestation tracking.
• Own the risk register day to day: intake, scoring, treatment plans, owner assignment, and review cadence.
• Map controls to the applicable framework(s) — NIST CSF / CIS Controls / SOC 2 / PCI DSS.
• Run exception and risk-acceptance governance: documented, time-bound, owned, and reviewed on expiry rather than renewed by silence.
• Own third-party and vendor risk reviews, including pre-contract security assessment and periodic reassessment of critical suppliers.
• Complete customer and partner security questionnaires; assemble evidence packages for audits, insurers, and M&A due diligence.

Identity & Access Management (IdAM)

• Implement, support, and troubleshoot Identity and Access Management (IdAM) and Privileged Access Management (PAM) solutions.
• Administer and maintain identity security platforms and directories (e.g., Okta, Password Safe).
• Design and enforce secure remote access.
• Partner with the identity team on SSO coverage and lifecycle so SaaS access follows the joiner/mover/leaver process rather than around it.

Google Workspace & SaaS Security

• Own the security configuration of Google Workspace: admin console hardening, context-aware access, 2SV enforcement, Drive external sharing controls, Gmail threat protection and routing rules, DLP policies.
• Govern third-party OAuth application access — review, approve, restrict, and periodically re-review what has been granted access to corporate data.
• Monitor Workspace alert center and audit logs; investigate and escalate anomalous access, sharing, and configuration change.
• Extend the same discipline to the broader SaaS estate: inventory sanctioned applications, review security configuration at onboarding, and identify shadow IT.

Cloud Security

• Operate the cloud security posture platform (Wiz) across GCP/AWS/Azure: coverage, policy tuning, and triage of misconfigurations, exposed workloads, and toxic combinations.
• Route findings to the accountable engineering owner with enough context to act, and track them to closure against defined SLAs.
• Review cloud IdAM configuration — over-permissive roles, standing access, unused credentials, key hygiene.
• Contribute cloud security requirements to new architecture and provide secure-by-default baselines that teams can adopt without a consultation.
• Partner with the network and endpoint security functions on shared telemetry, logging coverage, and detection gaps.

Security Assessments

• Plan and execute recurring internal security assessments against the control framework.
• Coordinate third-party penetration tests and external audits: scoping, scheduling, access, evidence, and readout.
• Own the finding lifecycle end to end — validation, owner assignment, remediation tracking, retest, and closure. A finding is not closed because it was assigned.
• Maintain a single consolidated view of open findings across all sources (pen test, audit, cloud posture, vulnerability scanning, assessments) so remediation is prioritized once, not five times.
• Support security awareness programs and phishing simulation where they intersect with control requirements.

Communication

• Write clearly and for the audience. Policy, findings, risk narratives, and evidence summaries are the primary output of this role — writing quality is a core requirement, not a soft skill.
• Explain a finding in terms of business impact and required action, not tool output. An engineer should be able to read the ticket and act without a meeting.
• Give the Director an accurate picture without prompting — what is closing, what is stuck, what needs escalation or a risk decision.
• Present assessment and compliance status to stakeholders across the business units at a defined cadence, showing trend and decision rather than raw counts.

Ownership & Accountability

This is stated explicitly because it is the primary filter for this role. The successful candidate:

• Owns the outcome, not the ticket. Nearly every fix belongs to someone else — driving it to closure still belongs here.
• Follows up without being reminded, and escalates with a recommendation when follow-up stops working.
• Verifies rather than assumes. Remediation is confirmed by retest, not by an email saying it was handled.
• Keeps the evidence current continuously, so audits and insurance renewals are a retrieval exercise rather than a fire drill.
• Raises the uncomfortable finding, including when it lands on an internal team or a senior stakeholder.

Required Qualifications

• 5+ years in information security, with demonstrated ownership of a GRC program or a substantial portion of one.
• Technical knowledge in designing and implementing Identity & Access Management (IdAM) and Privileged Access Management solutions.
• Hands-on experience with cloud security posture management (Wiz or comparable tool) and practical understanding of cloud IdAM and misconfiguration risk in at least one major provider.
• Administration or security-configuration experience with Google Workspace (or comparable enterprise SaaS suite), including sharing controls, DLP, and OAuth app governance.
• Experience running or supporting security assessments, audits, and penetration tests, including evidence production and remediation tracking.
• Working knowledge of at least one control framework — NIST CSF, CIS Controls, SOC 2, or PCI DSS — applied in a real environment rather than studied.
• Demonstrated ability to drive remediation through teams that do not report to you.
• Strong technical writing. Candidates should expect to provide a writing sample.
• Bachelor's degree or equivalent practical experience.

Preferred

• CISSP, CISA, CCSK, CISM, or cloud provider security certification.
• Experience administering and maintaining security platforms such as Okta, Password Safe, Crowdstrike, Wiz, Palo Alto XSIAM, and ExtraHop.
• Scripting for evidence collection and reporting automation (Python, PowerShell, or equivalent).
• Experience with cyber insurance underwriting questionnaires or M&A technology due diligence.
• Experience in media, broadcast, or another 24x7 operational environment.
• Familiarity with vulnerability management and endpoint security tooling (CrowdStrike) as a consumer of their output.

First-Year Success Measures

Timeframe - Expected Outcome

90 days - Policy library and risk register inventoried and current-state assessed; Wiz, Workspace, and IdAM configurations baselined against benchmark; consolidated open-findings view established; relationships built with each remediation owner.

6 months - Control framework crosswalk complete and evidence mapped; exception governance running with dated, owned entries; cloud, Workspace, and identity findings closing against SLA with measurable backlog reduction; third-party risk review process operating at onboarding.

12 months - Audit, questionnaire, and insurance evidence produced on request without a scramble; at least one full internal assessment cycle and one external test completed with findings closed or formally accepted; measurable reduction in external Drive exposure and over-permissive cloud/IdAM roles; risk register reviewed in a standing governance forum with business participation.

Working Conditions

• Occasional participation in incident response and after-hours escalation.
• Periods of elevated workload around audit, assessment, and insurance renewal cycles.