Cyber Security Engineer

KLDiscovery is seeking an early-career Cyber Security Engineer to support its Cyber Operations team across detection and incident response, vulnerability management, security engineering, AI security, and compliance activities. The role involves executing hands-on security operations, maintaining tooling and evidence, supporting remediation efforts, and developing toward greater domain ownership and independent execution.

Responsibilities:

• Contribute to detection engineering, writing, testing, and tuning SIEM detection rules and SOAR playbooks to improve the team's ability to identify and respond to threats automatically
• Support the SOC/IR function by validating and escalating CrowdStrike MDR-confirmed findings, ensuring accurate triage and appropriate internal escalation
• Assist with incident response activities like evidence collection, timeline reconstruction, containment actions, and post-incident documentation
• Monitor and respond to security alerts from tools operating outside MDR scope
• Contribute to SIEM and identity health monitoring flagging anomalies, reviewing detection coverage, and supporting SOAR playbook testing
• Own the vulnerability and exposure management program mechanics setting remediation SLA thresholds, driving prioritization decisions, and producing executive reporting on vulnerability posture
• Monitor and interpret real-time vulnerability and exposure findings from CrowdStrike Falcon Exposure Management, triaging findings, assessing risk, and prioritizing remediation based on exploitability and business impact
• Track and assess patch deployment failures, identifying systems where patches have not applied successfully, escalating gaps, and working with IT to drive remediation to closure
• Coordinate third-party penetration testing engagements by confirming scope, scheduling, internal stakeholder liaison, and tracking remediation of identified findings through to closure
• Maintain accurate exposure and remediation tracking records to support compliance evidence and executive reporting on vulnerability posture
• Assist with security architecture reviews for technology projects by reviewing requirements, identifying gaps, and documenting findings for senior engineer review
• Support configuration and maintenance of security tooling across endpoint, identity, cloud, and application security platforms
• Contribute to automation efforts: scripting, playbook testing, IaC security gate tasks, and CI/CD pipeline security support as directed
• Assist with documentation of security standards, runbooks, and technical procedures to support audit readiness and knowledge transfer
• Develop foundational awareness of AI security considerations including AI tool access governance, anomalous AI activity triage, and emerging AI risk patterns
• Support team-wide AI security responsibilities within your functional lane as directed by senior engineers
• Triage alerts involving AI tool misuse or anomalous AI-related activity as part of the analyst support function
• Gather and maintain evidence for compliance frameworks, including the verification of internal security control implementation
• Support the GRC team with technical control documentation, evidence quality review, and gap remediation tracking
• Standardize documentation practices to ensure security evidence is always audit-ready, not reconstructed at assessment time

Requirements:

• 3+ years of hands-on experience in information security, IT engineering, or a closely related technical field
• Experience with at least one of the following: SIEM platforms, vulnerability scanning tools, endpoint security (EDR/XDR), or cloud security tooling
• Experience with log analysis, alert triage, or security monitoring in a corporate environment
• Understanding of core security domains sufficient to execute assigned tasks independently: access management, encryption, network security, vulnerability management, and incident response
• Basic familiarity with cloud security concepts (AWS, Azure, or GCP) including IAM, logging, and posture monitoring
• A strong sense of ownership, when you take on a task, it gets done; you follow through without being chased, flag blockers early, and close the loop reliably
• Alert and attentive, you notice things others miss, take monitoring seriously, and understand that complacency in security operations has real consequences
• Detail-oriented with high standards for accuracy and you take documentation, evidence, and configuration tasks seriously
• A strong communicator, able to write clear technical documentation and summarize findings clearly for non-technical colleagues
• A collaborative team member, you contribute to a team environment where senior engineers mentor you and you are expected to share what you learn
• Growth-oriented, you actively seek feedback, invest in your own development, and approach mistakes as learning opportunities
• Discreet and trusted, you handle sensitive security findings, incident data, and client-related information with appropriate confidentiality
• Familiarity with scripting (Python, PowerShell, or Bash) for automation or reporting tasks is a meaningful differentiator
• Foundational understanding of AppSec concepts is a meaningful differentiator: SAST/DAST tooling, secure SDLC, and pipeline security
• Experience with AI security considerations (AI tool access governance, prompt injection awareness) is a plus
• Experience with MDR platforms (CrowdStrike Falcon Complete or equivalent) is a plus but not required
• Formal education in Information Security, Computer Science, IT, or a related field
• Relevant certifications such as GSEC or CISSP