Cyber Security Engineer

RSM Solutions, Inc. is seeking a Cyber Security Engineer to manage day-to-day operations of security solutions and respond to security breaches. The role involves maintaining security documentation, deploying security solutions, and monitoring security operations.

Responsibilities:

• Maintain up-to-date detailed knowledge of the IT security industry including awareness of new or revised security solutions, improved security processes, and the development of new attacks and threat vectors
• Participate in the creation of enterprise security documents (policies, standards, baselines, guidelines, and procedures) under the direction of the IT Security Manager, where appropriate
• Perform the deployment, integration, and initial configuration of all new security solutions and of any enhancements to existing security solutions in accordance with standard best operating procedures generically and the enterprise’s security documents specifically
• Maintain up-to-date baselines for the secure configuration and operations of all in-place devices, whether they be under direct control (i.e. security tools) or not (e.g. workstations, servers, network devices)
• Monitor all in-place security solutions for efficient and appropriate operations
• Review logs and reports of all in-place devices, whether they be under direct control (i.e. security tools) or not (e.g. workstations, servers, network devices). Interpret the implications of that activity and devise plans for appropriate resolution
• Design, build, and maintain security automation workflows to improve detection, response, vulnerability management, user access reviews, and compliance evidence collection
• Develop scripts, playbooks, integrations and automated workflows using tools such as PowerShell, Python, APIs, SOAR platforms, SIEM automation, Microsoft Graph, and ITSM platforms
• Automate repetitive security operations tasks including alert enrichment, case creation, containment actions, reporting, control validation, and exception tracking

Requirements:

• Extensive experience with security frameworks (e.g. ISO 27001/27002, NIST 800-53, NIST CSF etc.)
• At least 4-5 years of experience with EDR solutions - These guys are a heavy Microsoft Shop so, specific experience with the E5 stack (Microsoft Defender for Endpoint (MDE) is a gotta have
• At least 3-4 years of Experience with Sentinel for SIEM is a gotta have
• At least 3-4 years of experience with CrowdStrike is a gotta have. If you have CrowdStrike Falcon experience, that would be even better
• At least 3-4 years of experience with Azure (Entra ID)
• Experience with Pen testing tools such as Cobalt is a gotta have
• Security automation using PowerShell, Python, APIs, Microsoft Graph, SOAR, SIEM automation, or ITSM workflows
• Identity security, privileged access, MFA, SSO, and conditional access
• MITRE ATT&CK and threat-informed detection engineering experience
• Patching and IT Asset Management systems (ManageEngine Preferred)
• Security monitoring and governance for AI platforms and emerging technologies would be great to see (they use Abnormal Ai, so if you have experience with this tool, that would be a really great thing to see)