Security Engineer (Remote)

FMG is a leading all-in-one digital marketing platform empowering financial advisors and enterprises with scalable marketing solutions. They are seeking a Security Engineer to manage and enhance their security operations, focusing on endpoint protection, zero trust networking, and attack surface management.

Responsibilities:

• Security awareness program and phishing simulation — campaign design, execution, metrics, and follow-through
• Endpoint Detection & Response — we are deploying an upgrade in the near term; you’ll be part of that rollout and own ongoing operations
• Zero Trust network access and DNS security — currently revamping our network protections; this role will be responsible for it operationally
• Manage and operate our EASM platform — continuous monitoring, finding triage, and remediation coordination
• Coordinate with our third-party penetration testing partner — scoping, logistics, findings review, and remediation tracking
• SAST and SCM findings oversight — enough depth to understand findings, push back when warranted, and know when to escalate
• Monitor and respond to security alerts across our stack — SIEM, EDR telemetry, and related tooling
• Own relevant SOC 2 controls — this is everyone’s job here; you’ll carry your share of it
• Participate in vendor evaluations, new tooling assessments, and ad hoc projects as the team grows
• Access to a private & secure workspace, free from distractions
• Accessible during the assigned work schedule for regular duties and responsibilities as outlined by the supervisor
• An internet connection with speeds of 5 Megabits down / 3 Megabits up (5mbps/3mbps)

Requirements:

• 5-8 years of experience in an information security role with hands-on technical responsibilities
• Solid grounding in security operations — alert handling, incident triage, log analysis
• Familiarity with EDR concepts and endpoint security; direct CrowdStrike experience is a plus but not required
• Understanding of Zero Trust and SASE concepts; Cloudflare One experience is a plus but not required
• Exposure to DAST, EASM, or external attack surface tooling — you don't need to have built a program, but you should be able to read findings intelligently
• Enough AppSec fluency to review SAST output and have a credible conversation about what matters and what doesn't
• Familiarity with SIEM tooling, monitoring and response; DataDog experience is a plus here
• Experience with security awareness platforms (KnowBe4 or similar) is helpful
• Relevant certifications valued — CompTIA Security+, CySA+, PenTest+, or equivalent; we care more about demonstrated skill than credential collection
• Strong written communication — you'll be writing findings summaries, coordinating with vendors, and occasionally presenting to non-technical stakeholders
• You've got an offensive security bent — you think like an attacker, even when you're playing defense
• You pick up new tools quickly and don't need a perfect spec to get started
• You've been handed something ambiguous and made it work
• You're paying attention to where AI is taking this field and thinking about what that means for how you work