Cyber Security Engineer

RSM Solutions, Inc is recruiting a Cyber Security Engineer for a permanent remote role supporting a division of a larger holding company. The role focuses on operating security solutions, investigating and resolving breaches, implementing security technologies, maintaining security documentation and baselines, and developing automation for detection, response, vulnerability management, access reviews, and compliance.

Responsibilities:

• Maintain up-to-date detailed knowledge of the IT security industry including awareness of new or revised security solutions, improved security processes, and the development of new attacks and threat vectors
• Participate in the creation of enterprise security documents (policies, standards, baselines, guidelines, and procedures) under the direction of the IT Security Manager, where appropriate
• Perform the deployment, integration, and initial configuration of all new security solutions and of any enhancements to existing security solutions in accordance with standard best operating procedures generically and the enterprise’s security documents specifically
• Maintain up-to-date baselines for the secure configuration and operations of all in-place devices, whether they be under direct control (i.e. security tools) or not (e.g. workstations, servers, network devices)
• Monitor all in-place security solutions for efficient and appropriate operations
• Review logs and reports of all in-place devices, whether they be under direct control (i.e. security tools) or not (e.g. workstations, servers, network devices). Interpret the implications of that activity and devise plans for appropriate resolution
• Design, build, and maintain security automation workflows to improve detection, response, vulnerability management, user access reviews, and compliance evidence collection
• Develop scripts, playbooks, integrations and automated workflows using tools such as PowerShell, Python, APIs, SOAR platforms, SIEM automation, Microsoft Graph, and ITSM platforms
• Automate repetitive security operations tasks including alert enrichment, case creation, containment actions, reporting, control validation, and exception tracking

Requirements:

• candidates who have permanent authorization to work in the U.S. and will never require sponsorship (typically U.S. citizens or Green Card holders)
• candidates that reside in the US for this role
• that ability to work independently well
• individuals who enjoy sharing their knowledge with others
• Extensive experience with security frameworks (e.g. ISO 27001/27002, NIST 800-53, NIST CSF etc.)
• At least 4-5 years of experience with EDR solutions - These guys are a heavy Microsoft Shop so, specific experience with the E5 stack (Microsoft Defender for Endpoint (MDE) is a gotta have
• At least 3-4 years of Experience with Sentinel for SIEM is a gotta have
• At least 3-4 years of experience with CrowdStrike Falcon is a gotta have
• At least 3-4 years of experience with Azure (Entra ID)
• Experience with Pen testing tools such as Cobalt is a gotta have
• that mix of red team and blue team is a gotta have
• Security automation using PowerShell, Python, APIs, Microsoft Graph, SOAR, SIEM automation, or ITSM workflows
• Identity security, privileged access, MFA, SSO, and conditional access
• MITRE ATT&CK and threat-informed detection engineering experience
• ManageEngine Preferred
• Security monitoring and governance for AI platforms and emerging technologies would be great to see (they use Abnormal Ai, so if you have experience with this tool, that would be a really great thing to see)