Cybersecurity Engineer

Position Summary

The Cybersecurity Engineer reports to the Director of Cybersecurity and is responsible for engineering, operating, monitoring, and continuously improving cybersecurity controls across the enterprise. This hands-on role combines security engineering, security operations, incident response support, vulnerability management, and third-party provider oversight to strengthen the organization's security posture.

The Cybersecurity Engineer works closely with Systems, Networking, IT/OT Integration, Support Services, Cybersecurity leadership, and external service providers to ensure security controls are properly implemented, monitored, and integrated into technology operations. This role focuses on translating security findings into practical remediation actions, sustainable control improvements, and operational standards that reduce organizational risk while supporting business objectives.

---

Key Responsibilities

Security Controls Engineering & Operations

• Design, implement, configure, and maintain cybersecurity controls across identity, endpoint, email, network, cloud, and security monitoring environments.
• Ensure security controls are consistently deployed, properly configured, and aligned with enterprise architecture standards.
• Identify and remediate control gaps, configuration weaknesses, and operational inefficiencies.
• Drive standardization and operational hygiene to improve control effectiveness and reduce risk.

Security Monitoring, Detection & Incident Response Support

• Monitor, triage, and investigate security alerts and telemetry across enterprise IT and OT-adjacent environments.
• Distinguish legitimate security events from false positives, system misconfigurations, or expected activity.
• Escalate validated security events with clear technical documentation and recommendations.
• Support incident response activities including log analysis, containment efforts, recovery coordination, remediation tracking, and control validation.
• Document incident timelines, findings, corrective actions, and lessons learned.

Identity & Access Security

• Implement and maintain identity security controls including multi-factor authentication (MFA), privileged access controls, and access monitoring capabilities.
• Collaborate with Systems and Networking teams to integrate security controls into technology designs and operational workflows.
• Investigate and remediate identity-related security issues, anomalies, and control deficiencies.

Endpoint & Email Security

• Administer and optimize endpoint protection and email security solutions.
• Maintain security policies, configurations, and monitoring processes to ensure continued effectiveness.
• Validate control performance and address potential security gaps.
• Support efforts to streamline security tooling and reduce unnecessary complexity.

Vulnerability Management & Remediation

• Support enterprise vulnerability management programs through scan reviews, vulnerability validation, risk prioritization, remediation tracking, and exposure reduction efforts.
• Translate vulnerability findings into practical remediation plans, control enhancements, or compensating controls.
• Coordinate remediation activities with internal teams and external partners.
• Monitor remediation progress and provide regular reporting on risk reduction initiatives.

OT-Adjacent Security Enablement

• Support security monitoring, control implementation, and incident readiness efforts within OT-adjacent environments.
• Partner with IT/OT Integration teams to enhance visibility and security controls while minimizing operational disruption.
• Assist with the evaluation and deployment of security technologies supporting manufacturing and operational environments.

Provider Coordination & Quality Assurance

• Serve as the primary internal escalation point for provider-supported security operations.
• Review and validate third-party investigations, recommendations, configurations, and implementation outcomes.
• Identify recurring service delivery issues, alert fatigue, monitoring gaps, and operational deficiencies.
• Drive corrective actions to improve service quality, accountability, and operational effectiveness.

Documentation & Continuous Improvement

• Develop and maintain security control documentation, configuration standards, technical procedures, and operational runbooks.
• Analyze recurring security issues and implement corrective and preventive improvements.
• Contribute to continuous improvement initiatives that strengthen overall cybersecurity maturity and operational effectiveness.
• Support security metrics collection, reporting, and performance measurement activities.

---

Required Qualifications

Education

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related field preferred.
• Equivalent combination of education, certifications, and relevant experience may be considered.

Experience

• Minimum of 4 years of experience in cybersecurity engineering, security operations, incident response, vulnerability management, infrastructure security, or related disciplines.
• Hands-on experience implementing and operating security controls across identity, endpoint, email, network, cloud, monitoring, and response platforms.
• Experience with security alerting, log analysis, incident triage, vulnerability assessment, remediation coordination, and security investigations.
• Demonstrated ability to troubleshoot complex technical issues and drive resolution through structured analysis.

---

Preferred Qualifications

• Experience supporting distributed, multi-site, manufacturing, or industrial environments.
• Familiarity with OT-adjacent security practices, production uptime requirements, and operational technology environments.
• Experience working with managed security service providers (MSSPs) or outsourced security operations models.
• Knowledge of IT Service Management (ITSM) processes and platforms.
• Experience with detection engineering, alert tuning, vulnerability management programs, and security reporting metrics.
• Relevant industry certifications such as Security+, CySA+, CISSP, GSEC, GCIH, GCIA, SC-200, SC-300, AZ-500, or comparable certifications.

---

Knowledge, Skills & Abilities

• Strong understanding of cybersecurity principles, security architecture, and operational security controls.
• Knowledge of identity and access management, endpoint protection, email security, network security, cloud security, and vulnerability management practices.
• Ability to analyze security events, identify root causes, and develop effective remediation solutions.
• Strong documentation, organizational, and project coordination skills.
• Excellent verbal and written communication skills with the ability to explain technical concepts to both technical and non-technical audiences.
• Strong attention to detail and commitment to operational excellence.
• Ability to manage multiple priorities in a fast-paced environment while maintaining high-quality execution.

---

Success Measures (First 12 Months)

The Cybersecurity Engineer will be considered successful when:

• Security controls are consistently deployed, maintained, and demonstrate reduced configuration gaps and operational deficiencies.
• Security monitoring generates higher-quality alerts, fewer false positives, and more timely escalation of validated threats.
• Incident response processes produce improved documentation, analysis, and remediation outcomes.
• High-risk vulnerabilities are remediated more efficiently through coordinated execution and effective compensating controls.
• OT-adjacent environments benefit from improved visibility, monitoring, and security enablement without impacting production operations.
• Provider-supported security operations demonstrate higher quality, accountability, and measurable performance improvements.

---

Role Boundaries

Primary Ownership

• Cybersecurity controls engineering and implementation
• Security tooling administration and operations
• Security monitoring and alert triage
• Security investigations and incident response support
• Vulnerability management and remediation coordination
• Security operations provider oversight and quality assurance

Not Responsible For

• Enterprise cybersecurity strategy ownership
• Security policy approval authority
• Risk acceptance decisions
• Enterprise Networking architecture ownership
• Enterprise Systems architecture ownership
• Operational Technology (OT) systems ownership
• Plant operations management

Collaborative Responsibilities

• Partner with IT/OT Integration teams to support OT-adjacent security monitoring, control enablement, and incident readiness activities.
• Collaborate with Infrastructure, Networking, Systems, a