Sr Cyber Security Engineer

OnTrac is a provider of same-day and next-day delivery services in the U.S. The Sr. Cyber Security Engineer will own identity and access management, privileged access management, endpoint and cloud security, vulnerability management, and Microsoft 365 security. The role partners with IT, CSIRT, and GRC teams to secure infrastructure, respond to incidents, and implement technical controls and automated evidence collection.

Responsibilities:

• Identity and privileged-access engineering: Design, deploy, and maintain enterprise identity services across Entra ID and hybrid Active Directory, including SAML/OIDC federation, SSO, Conditional Access, MFA and phishing-resistant authentication, joiner/mover/leaver automation, RBAC, role and group governance, access reviews, credential vaulting, session monitoring, just-in-time elevation, tiered administration, service-account governance, and break-glass procedures
• Microsoft 365 and Entra ID security: Harden and administer Exchange Online, SharePoint, OneDrive, Teams, Defender, Purview, and the Entra ID tenant, including configuration baselines, application registration and OAuth consent governance, license-aligned feature enablement, and posture remediation
• Vulnerability, endpoint and mobile security: Operate Qualys, including asset coverage, tagging, authenticated scanning, agents, policy compliance, and risk-based reporting; drive remediation within established SLAs; and manage compliance, configuration, enrollment, encryption, patching, application deployment, and device-posture signals across Intune, JAMF, and Google device management for Windows, macOS, iOS, and Android
• IT partnership and security by design: Serve as the embedded security engineering partner for directory, endpoint, network, and infrastructure changes, applying security by design to projects, migrations, and new deployments without unnecessarily slowing delivery
• CSIRT enablement and Tier 3 escalation: Support complex identity and endpoint incidents through containment actions, including token revocation, account disablement, and device isolation; assist with evidence collection, log-source onboarding, and detection tuning in partnership with CSIRT and the MDR provider
• GRC enablement and technical controls: Translate requirements from NIST CSF, ISO 27001, and SOC 2 into technical configurations and automated evidence collection that supports audits, third-party risk reviews, and risk-remediation tracking
• Automation, documentation and mentorship: Automate recurring identity, access, integration, and reporting tasks using PowerShell, Microsoft Graph, and Python; maintain runbooks, SOPs, architecture diagrams, and platform standards; and provide technical guidance to analysts and junior engineers

Requirements:

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience
• 7+ years of progressive experience in IT and Security, including at least 3 years dedicated to IAM or security engineering in an enterprise environment
• Demonstrated hands-on ownership of at least two of the following:
• Entra ID / Microsoft 365
• A PAM platform
• Qualys or equivalent vulnerability management platform
• Intune / JAMF device management
• Hands-on expertise with identity lifecycle, RBAC design, entitlement and access certification, federation and SSO integrations, and privileged-access tooling and workflows
• Strong working knowledge of Entra ID, including Conditional Access, Identity Protection, PIM, and entitlement management, plus the Microsoft 365 security and compliance stack
• Working knowledge of Intune, JAMF, and Google device management, including compliance policies, configuration profiles, and application deployment across mixed operating-system environments
• Strong scripting and automation skills using PowerShell, Microsoft Graph, Python, or Bash
• Ability to interpret NIST CSF, ISO 27001, or SOC 2 and implement the technical controls and evidence required to meet them
• Certifications such as SC-300, SC-200, AZ-500, CISSP, CISM, GIAC GCIA, GIAC GDSA, or relevant PAM, JAMF, or Qualys vendor certifications
• Ability to travel up to 10%
• You explain technical risk clearly to non-technical stakeholders and collaborate effectively across IT, CSIRT, GRC, and business teams
• You bring proficiency across identity, endpoint, network security, cloud environments including Azure, GCP, and AWS, and SaaS administration, moving effectively between domains as priorities shift
• You analyze complex issues by thoroughly evaluating multiple variables and their technical and business implications
• You define appropriate methods and procedures for new assignments, using sound judgment to select, adapt, and evaluate advanced techniques
• You build strong stakeholder relationships beyond your area of expertise, adapting your communication style and using persuasive skills to align decisions with broader business objectives