Lead Security Engineer

CBIZ, Inc. is a leading professional services advisor to middle-market businesses nationwide. The Lead Security Engineer is responsible for designing, implementing, and improving enterprise security technologies and controls across various domains, ensuring a secure environment and operational resilience.

Responsibilities:

• Design, implement, harden, and maintain enterprise security controls and reference architectures across: Microsoft Azure and Azure Virtual Desktop (AVD), Amazon Web Services (AWS), Microsoft 365 security and compliance platforms, Hybrid identity, endpoint, email, and data protection environments
• Engineer secure-by-default configurations and technical guardrails that reduce attack surface, improve resilience, and support scalable enterprise operations
• Translate business, compliance, and security requirements into practical engineering designs and sustainable technical solutions
• Evaluate current-state architectures, identify control gaps, and implement improvements that strengthen security posture while maintaining operational usability
• Partner with infrastructure, cloud, networking, systems, and endpoint teams to embed security into enterprise platforms, workflows, and lifecycle processes
• Engineer and operationalize controls for identity protection, phishing defense, DLP, conditional access, privileged access, tenant security baselines, and cloud workload protection
• Secure workloads, identities, and data across hybrid and multi-cloud environments through design standards, configuration baselines, and measurable technical guardrails
• Support and troubleshoot certificate-based authentication, encryption, and PKI-related services, including lifecycle considerations such as issuance, renewal, revocation, and dependency management
• Improve authentication security, access control design, and privileged access protections across enterprise systems and cloud platforms
• Design and validate visibility and monitoring coverage for cloud, identity, endpoint, email, and platform security events to ensure reliable telemetry and actionable data
• Build, administer, and continuously improve core security platforms and integrations, including: SIEM and log ingestion pipelines, SOAR and workflow automation platforms, XDR/EDR and endpoint security tooling, Network and zero trust security controls, CASB, DLP, and data security platforms, Identity and access management controls, Email and collaboration security technologies
• Develop and maintain automation using PowerShell, Python, Bash, APIs, and workflow tooling to support enrichment, orchestration, reporting, evidence collection, system validation, and control enforcement
• Design and optimize log collection, parsing, normalization, retention, and access models to improve searchability, detection quality, auditability, and investigative efficiency
• Improve platform reliability, scalability, and maintainability through lifecycle upgrades, engineering standards, technical documentation, and structured change control
• Evaluate and responsibly implement AI-enabled security capabilities where they provide measurable improvements in efficiency, visibility, or control effectiveness
• Engineer and refine analytic rules, correlation logic, alerting thresholds, and detection content across cloud, identity, endpoint, email, and network security technologies
• Validate detections and controls through testing, simulation, tuning, and gap analysis to improve fidelity and reduce noise
• Translate lessons learned from incidents, platform issues, and control failures into durable engineering improvements such as new detections, automation, hardening standards, and preventive safeguards
• Contribute to complex investigations and incident response activities as a senior technical resource, including root cause analysis, containment support, and remediation validation
• Participate in on-call or escalation support as needed for significant incidents or high-priority technical issues
• Own complex technical initiatives from design through implementation, support, optimization, and documentation
• Balance project-based engineering work with platform maintenance, technical debt remediation, backlog reduction, and continuous control improvement
• Create and maintain actionable documentation including architecture diagrams, standards, SOPs, runbooks, playbooks, and knowledge base content aligned to production reality
• Define and track measurable improvements in platform health, control coverage, alert quality, automation effectiveness, and engineering maturity
• Serve as a senior technical contributor who establishes patterns, improves standards, and advances overall enterprise security engineering maturity
• Partner closely with GRC, IT, Cloud, Networking, Systems, Endpoint, and business teams to develop secure designs and pragmatic technical solutions
• Clearly communicate architecture decisions, technical findings, control gaps, implementation plans, and remediation priorities to both technical and non-technical stakeholders
• Provide technical guidance and mentorship to analysts and engineers, helping elevate engineering practices, platform understanding, and troubleshooting capability across the team
• Influence cross-functional stakeholders and help remove blockers to drive timely technical outcomes

Requirements:

• College Degree or equivalent required
• 8 years related experience
• Expert technical knowledge
• Knowledge of industry regulations
• Ability to lead and coordinate the team activities of others
• Ability to formulate, document and recommend new policies and procedures
• Able to work in and lead a team
• Demonstrated ability to communicate verbally and in writing throughout all levels of an organization, both internally and externally
• Ability to travel as required by business and on-call availability
• 10+ years of experience in Information Security, Security Engineering, Infrastructure Security, or closely related technical roles, including senior or lead ownership of complex security initiatives
• Demonstrated hands-on expertise designing, implementing, and supporting enterprise security technologies across cloud, identity, endpoint, network, email, and data protection domains
• Deep experience securing cloud environments such as Azure and/or AWS, and operationalizing Microsoft 365 security capabilities including Defender, email protection, DLP, conditional access, and identity protections
• Strong experience securing and supporting Azure Virtual Desktop (AVD) environments, including identity controls, endpoint protections, logging, monitoring, and configuration hardening
• Working knowledge of PKI, certificate-based authentication, and encryption, with the ability to troubleshoot production issues and understand operational and security impacts
• Strong scripting and systems skills, including PowerShell as a core requirement, with Python and/or Bash strongly preferred
• Hands-on experience building and maintaining security platforms such as SIEM, SOAR, XDR/EDR, log pipelines, and platform integrations, including data onboarding, content tuning, and workflow development
• Strong understanding of security engineering fundamentals including networking, identity and access management, operating systems, endpoint behavior, logging and telemetry, and common attack techniques
• Demonstrated ability to work independently, exercise strong technical judgment, and drive complex engineering efforts through completion
• Security certifications such as CISSP, GIAC (GCIA, GCIH, GCED), Azure/AWS security certifications, or other relevant technical credentials
• Strong command of enterprise networking concepts including TCP/IP, VLANs, routing, packet analysis, DNS, and application protocols such as HTTP/S, SMTP, and LDAP
• Experience supporting Windows and Linux systems in enterprise environments, including Active Directory, authentication protocols such as NTLM and Kerberos, domain services, and systems hardening practices
• Advanced experience in SIEM content engineering, including architecting correlation logic, custom parsers, rule tuning, and dashboards using platforms and query languages such as KQL, SPL, or equivalent tools
• Advanced automation experience using PowerShell and Python, including API integrations, orchestration, data transformation, workflow design, and scalable operational automation