Senior Security Engineer

GXA is seeking a highly capable Security Engineer to support the delivery and operation of their gShield security services. This hands-on role focuses on incident response, security tool operations, remediation execution, client security support, and internal security improvement initiatives.

Responsibilities:

• Serve as a Tier 3 escalation point for active security incidents, including business email compromise (BEC), adversary-in-the-middle (AiTM), ransomware, and account compromise
• Lead technical analysis during incident response and war room events, including log review, IOC hunting, and lateral movement tracing
• Execute containment and eradication actions such as endpoint isolation, session revocation, and credential resets
• Coordinate with SOC teams and vendor threat intelligence teams during active investigations and containment efforts
• Produce accurate incident timelines, technical findings, and evidence packages for vCISO review and client-facing follow-up
• Operate daily within the gShield toolstack, including platforms such as Huntress, Microsoft Defender for Endpoint (MDE), Cyrisma, DNSFilter, SIEM, and related security technologies
• Perform alert triage, risk identification, scan issue resolution, and follow-through on issues surfaced by security tools
• Support SIEM operations including query development, alert review, and rule tuning
• Assist in tuning detection logic, scan settings, and platform effectiveness in coordination with Centralized Services and security leadership
• Monitor for security gaps, suspicious activity, and control weaknesses across managed environments
• Execute technical remediation items identified through MRMMs, preventative actions, vulnerability reviews, and security recommendations
• Support gShield deliverables through technical validation, evidence gathering, scan review, and vulnerability analysis
• Act as a quality assurance resource for client onboarding into the gShield toolstack, while execution remains with onboarding and Centralized Services teams
• Assist with client hardening efforts and follow-through on security improvement actions across managed environments
• Support remediation of internal GXA security backlog items, including POA&M-related work
• Assist with rollout and support of phishing-resistant MFA, passkeys, and other internal security initiatives
• Contribute to security engineering efforts related to Intune, Defender, ThreatLocker, AppLocker, and RMM scripting
• Help improve internal security controls, tool effectiveness, and technical enforcement mechanisms
• Write and maintain security engineering SOPs, runbooks, detection playbooks, and response procedures related to gShield operations and incident response
• Document technical findings, repeatable procedures, and lessons learned from incidents and tool operations
• Collaborate with security leadership and technical stakeholders on process improvements, skill development, and automation opportunities
• Contribute technical depth to broader security documentation where needed, while recognizing that ownership of policy, standards, and governance documentation remains with security leadership and related functions

Requirements:

• 5–7+ years of experience in cybersecurity, security operations, security engineering, or incident response roles
• Strong hands-on experience with incident response, threat detection, and security operations workflows
• Experience working with security platforms such as Microsoft Defender, Huntress, DNSFilter, SIEM solutions, vulnerability management tools, and endpoint security technologies
• Ability to investigate security alerts, analyze logs, trace attacker activity, and support containment and remediation
• Familiarity with common attack types including phishing, BEC, account compromise, ransomware, and identity-based attacks
• Experience supporting security controls in Microsoft 365 and endpoint environments
• Strong documentation skills and ability to write clear technical procedures and findings
• Ability to work calmly and methodically during active incidents and escalations
• Strong collaboration and communication skills with both internal teams and leadership stakeholders
• Experience in an MSP, MSSP, or multi-client environment
• Familiarity with Intune, Microsoft Defender, AppLocker, ThreatLocker, and RMM-based scripting or automation
• Understanding of CIS benchmarks, security hardening standards, and configuration drift monitoring
• Experience supporting vulnerability remediation and technical aspects of vCISO or managed security programs
• Security certifications such as Security+, CySA+, SC-200, SC-300, AZ-500, GCIH, GCIA, or similar are a plus