IT Security Engineer

Priority Ambulance is hiring an IT Security Engineer to engineer, implement, administer, test, document, and continuously improve the organization’s cybersecurity technologies and controls. The role translates security strategy and requirements into technical solutions and supports security monitoring, identity and access security, vulnerability management, incident response, architecture, automation, and security operations.

Responsibilities:

• Ability to assess complex cybersecurity issues, isolate root causes, and apply sound technical judgment
• Ability to explain technical risks and remediation options clearly to both technical and nontechnical stakeholders
• Ability to plan and execute work with accuracy, appropriate change control, and thorough documentation
• Ability to manage competing priorities, exercise discretion, and escalate risks or incidents in a timely manner
• Ability to work independently in a remote setting while collaborating across locations and business functions
• Design, configure, implement, test, administer, and improve cybersecurity controls and technologies
• Translate security requirements and architectural direction into technical configurations and solutions
• Evaluate existing security configurations and identify opportunities for improvement
• Develop implementation plans, configuration standards, testing procedures, and rollback procedures
• Validate implemented controls and document results
• Partner with infrastructure, networking, application, development, and operations teams to implement security requirements
• Maintain secure configuration baselines and periodically validate deployed controls against those baselines
• Engineer and maintain enterprise security monitoring and detection capabilities
• Develop and tune detection logic for suspicious and malicious activity
• Develop threat-hunting and investigative queries
• Onboard security telemetry and ensure appropriate logging coverage
• Troubleshoot log collection, parsing, normalization, and ingestion issues
• Develop security dashboards and operational reporting
• Evaluate detection effectiveness and identify monitoring gaps
• Maintain documentation describing security telemetry, detection logic, and response procedures
• Engineer and maintain identity and access security controls
• Support multifactor authentication, conditional access, authentication policies, privileged access, and identity protection capabilities
• Review administrative, service, application, and workload identities
• Implement and validate least privilege of access controls
• Investigate suspicious authentication and accountancy activity
• Assist with privileged-access security and administrative account protection
• Develop identity-related security monitoring and detection capabilities
• Test proposed identity-security changes before production implementation
• Administer and improve vulnerability and exposure-management capabilities
• Manage authenticated, agent-based, and network-based security assessments where applicable
• Research vulnerabilities, security advisories, attack techniques, and emerging threats
• Analyze vulnerability severity, exploitability, exposure, asset criticality, and business impact
• Prioritize remediation activities based on organizational risk
• Coordinate remediation efforts with system, infrastructure, and application owners
• Perform post-remediation validation
• Maintain vulnerability-management documentation, metrics, and technical evidence
• Identify systemic security weaknesses rather than treating vulnerabilities solely as individual findings
• Serve as a technical escalation point for complex security events and incidents
• Investigate endpoint, identity, network, cloud, email, and application security events
• Analyze authentication activity, system behavior, processes, network activity, logs, and other security telemetry
• Determine the scope and potential impact of security incidents
• Perform or coordinate authorized containment and remediation actions
• Collect and preserve technical evidence
• Identify indicators of compromise and relevant attacker behaviors
• Develop additional detections based on investigation findings
• Perform root-cause analysis
• Document investigations, findings, remediation, and lessons learned
• Support organizational incident-response activities when required
• Support the IT Security Director in implementing organizational security architecture
• Review proposed system and application designs for technical security requirements
• Develop and document security requirements for new technologies
• Evaluate network connectivity, authentication, authorization, encryption, identity, logging, and monitoring requirements
• Create and maintain security and data-flow diagrams
• Validate security boundaries and least privilege principles
• Evaluate service and workload identity designs
• Assist with securely integrating applications, databases, APIs, cloud services, infrastructure, and third-party systems
• Conduct post-implementation security validation
• Participate in application and system security reviews
• Assist with secure development and deployment requirements
• Review application authentication and authorization controls
• Evaluate APIs, service accounts, application identities, secrets management, and supporting infrastructure
• Assist with database and application-level access-control design
• Establish monitoring and detection requirements for newly implemented technologies
• Support technical security testing of internally developed and third-party applications
• Assist with security requirements associated with organizational adoption of AI and other emerging technologies
• Perform technical components of cybersecurity and technology risk assessments
• Evaluate proposed applications, services, infrastructure, integrations, and other technologies
• Analyze vendor-provided technical and security documentation
• Validate authentication, encryption, logging, access control, data handling, vulnerability management, monitoring, and other security capabilities
• Conduct hands-on technical validation where appropriate
• Document technical findings, identified risks, recommended controls, and remediation requirements
• Validate remediation activities prior to production implementation when required
• Create and maintain security architecture documentation
• Create network, system, and data-flow diagrams
• Develop technical implementation documentation
• Develop and maintain standard operating procedures and technical runbooks
• Document security configurations and baselines
• Maintain investigation and incident-response procedures
• Document vulnerability-management processes
• Document security monitoring and detection requirements
• Maintain inventories of applicable security controls and integrations
• Document testing, validation, and remediation activities
• Maintain technical evidence supporting security assessments, audits, and compliance activities
• Ensure engineering processes are repeatable and are not dependent on undocumented institutional knowledge
• Develop automation supporting security engineering and operations
• Integrate security technologies through supported APIs and automation capabilities
• Automate repetitive investigation, evidence-collection, enrichment, containment, and remediation processes where appropriate
• Develop automated security response workflows
• Maintain security scripts and associated technical documentation
• Build repeatable reporting and control-validation processes
• Evaluate opportunities to reduce manual security workload through safe and controlled automation
• Validate the operational health of security controls and monitoring capabilities
• Investigate high-risk or technically complex security alerts
• Support escalation of suspected or confirmed incidents
• Validate endpoint, identity, email, network, vulnerability, cloud, and application security coverage
• Troubleshoot failures in security telemetry or technical controls
• Provide advanced technical support to security analysts and other IT personnel

Requirements:

• 3+ years of hands-on cybersecurity, security engineering, infrastructure security, systems engineering, systems administration, network administration, or equivalent professional experience
• Experience administering enterprise cybersecurity technologies
• Strong understanding of identity and access-management security
• Working knowledge of TCP/IP, DNS, HTTP/S, firewalls, VPNs, routing, network segmentation, and other enterprise networking concepts
• Experience working with security monitoring and event-management technologies (SIEM)
• Experience analyzing security logs and investigating cybersecurity events
• Understanding of endpoint detection and response concepts
• Working knowledge of vulnerability and exposure-management practices
• Experience supporting enterprise operating systems and infrastructure
• Ability to independently research cybersecurity threats, vulnerabilities, and technical issues
• Strong troubleshooting and root-cause-analysis capabilities
• Strong technical documentation skills
• Ability to translate security risks into actionable technical remediation
• Ability to collaborate effectively with infrastructure, application, development, operations, and business teams
• Enterprise Endpoint Security and EDR technologies
• SIEM and security analytics platforms
• Identity and access-management technologies
• Vulnerability and exposure-management platforms
• Email security technologies
• Network security technologies
• Cloud security technologies
• Security orchestration and automation
• Scripting languages such as PowerShell or Python
• REST APIs and JSON
• Security query languages
• Relational database fundamentals
• System and application logging
• Syslog and other common telemetry protocols
• Enterprise Windows administration
• Directory and identity services
• Source control and version-management practices
• Security+
• CySA+
• CISSP
• GIAC security certifications
• Cloud security certifications
• Identity and access-management certifications
• Incident-response or security-operations certifications
• Equivalent demonstrated hands-on engineering experience may be considered in place of certifications