Senior IT Security Operations Engineer (Remote)

Lakeshore Learning Materials is seeking a Senior IT Security Operations Engineer to own and optimize the security tools that protect the company. The role also develops preventative measures, investigates and remediates threats, leads incident response, and mentors security analysts while collaborating with IT, business stakeholders, and leadership.

Responsibilities:

• Owning the administration and optimization of our security tools, including S1 and Tanium, Active directory, Okta, and M365, endpoint protection, incident detection and vulnerability management, and fine-tuning alerts and automation so the team can focus on what matters
• Developing and implementing preventative security measures, from detection and monitoring to exploit prevention
• Investigating threats and driving remediation efforts across IT and business teams, making sure fixes are completed and lessons are carried forward
• Collaborating with IT and business stakeholders to identify gaps, recommend improvements and strengthen our overall security posture
• Monitoring emerging threats, vulnerabilities and exploits, and translating what you learn into practical improvements to how we detect and prevent risk
• Leading incident response when it’s needed, from first alert to resolution, and presenting clear findings and lessons learned to leadership
• Mentoring and coaching our Information Security Analysts, and leading quarterly tabletop exercises and security awareness training that help employees spot and stop threats

Requirements:

• Bachelor's degree in computer science, cybersecurity or a related field, or equivalent work experience
• 7+ years of experience in information security, including security operations, threat investigation or incident response
• Hands-on experience with S1 and Tanium, Active directory, Okta, and M365
• Hands-on experience administering and optimizing security tools from third parties and cloud providers, such as endpoint protection, firewalls, IDS/IPS, vulnerability management, WAF and IAM
• Experience with security platforms such as SIEM, EDR and SOAR
• Experience securing AWS cloud environments
• Strong knowledge of security frameworks and best practices, including NIST, ISO and MITRE, plus NIST 800-53, PCI, CIS and CSA CCM
• Comfortable scripting in Python, PowerShell or Bash
• Experience putting threat intelligence services to work in a production environment
• You build trust and influence with people at every level, including senior leadership
• You explain security risk clearly and practically—in a meeting room or in writing
• You stay steady and make sound calls when the situation is unclear and the stakes are high
• You enjoy helping other analysts grow and sharing what you know
• Certifications such as CISSP
• Ability to design security-relevant infrastructure as code (IaC)