Information Security Engineer

*Hybrid Position*
We are seeking a highly skilled and motivated Information Security Engineer to join our IT Security team. In this role, you will be a key defender of our infrastructure, bridging the gap between advanced threat defense, cloud security, and corporate compliance.
The ideal candidate possesses a deep technical understanding of modern cloud architectures (SASE/CASB), a proactive mindset for threat hunting, and the diligence required to manage Business Continuity/Disaster Recovery (BC/DR) operations and data governance via Microsoft Purview.
JOB DUTIES AND RESPONSIBILITIES:

1. Network & Cloud Security (SASE, CASB, Firewalls)

Design, deploy, and maintain Next-Generation Firewall (NGFW) policies and rules ensuring least-privilege access.
Manage and optimize our Secure Access Service Edge (SASE) architecture to support a secure remote/hybrid workforce.
Implement and monitor Cloud Access Security Broker (CASB) solutions to gain visibility into shadow IT, enforce data compliance, and prevent data leakage across SaaS applications.
Maintain firewall change management processes, including peer review, staging/testing, and post-change validation.

2. Threat Hunting & Incident Response

Proactively conduct threat hunting campaigns across network, endpoint, and cloud logs to identify anomalous behavior and latent threats that bypass traditional security controls.
Analyze security telemetry (SIEM/XDR) to reconstruct attack vectors and develop custom detection rules.
Act as a core member of the Incident Response team, including containment, eradication, and post-incident analysis.
Maintain current awareness of emerging threat actor groups, CVEs, and exploitation trends relevant to our industry and technology stack.
Remain available outside of standard business hours to respond to escalated, high-priority security events as needed.

3. Business Continuity & Disaster Recovery (BC/DR)

Collaborate with business stakeholders to develop, maintain, and update Business Continuity and Disaster Recovery plans.
Coordinate and lead regular BC/DR tabletop exercises and technical disaster recovery drills (failovers, backups restoration).
Ensure defined RPOs and RTOs are achievable, tested, and aligned with regulatory requirements — flagging gaps to leadership with clear remediation paths.

4. Microsoft Purview: Data Governance & eDiscovery

Administer and optimize the Microsoft Purview compliance suite with hands-on ownership of: Information Protection (sensitivity labels, auto-labeling policies), Data Loss Prevention (DLP) policies across M365 and endpoint, Compliance Manager (assessment tracking, control mapping), and Advanced eDiscovery.
Design and manage end-to-end eDiscovery workflows: creating review sets, applying legal holds, running targeted content searches, managing custodian communications, and producing defensible data exports in coordination with legal counsel.
Develop and refine DLP policies to reduce false positives, improve policy coverage, and generate actionable alerts — working with business units to balance security with operational productivity.
Monitor Purview audit logs and compliance dashboards, escalating anomalies and producing regular reports for security leadership and legal/compliance stakeholders.

OTHER JOB DUTIES AND RESPONSIBILITIES:

Assists in the development of new business for Firstrust. Is alert to expressed customer/prospect needs to suggest appropriate services. Directs customers to appropriate person to establish business relationships.

Other duties as assigned.

PHYSICAL AND SENSORY REQUIREMENTS:

Prolonged periods sitting at a desk and working on a computer.
Regularly required to drive a motor vehicle, occasional air travel, attending meetings at various venues, including but not limited to customers’ offices and/or properties, restaurants and other meeting locations, and ascend/descend stairs and or ladders occasionally to perform inspections.
The employee may be required to lift files/materials up to 20 pounds to take to various locations.
The incumbent will be expected to operate a computer terminal.
Prolonged periods sitting at a desk and working on a computer

POTENITAL ON-THE-JOB-RISKS:

None identified.

EDUCATION, TRAINING AND EXPERIENCE:

Education: Bachelor’s degree in Computer Science, Cyber Security, Information Technology, or equivalent practical experience.
Experience: 5+ years of progressive experience in cybersecurity engineering or a dual security/compliance role.
Technical Expertise:

Firewalls: Hands-on production-level configuration and administration of NGFW platforms.
Threat Hunting: Demonstrated experience running structured hunting campaigns, not just reactive alert investigation. Must be able to articulate past hunts, methodologies used, and outcomes achieved
SIEM/XDR: Proficiency in KQL (Microsoft Sentinel) and/or Splunk SPL for threat hunting, detection engineering, and forensic analysis.
Experience administering or supporting SASE/CASB platforms.
Microsoft Purview: Meaningful hands on experience with DLP Policies, Compliance Manager, Information Protection, Advanced eDiscovery).
Strong understanding of threat actor TTPs (MITRE ATT&CK framework) and query languages (e.g., KQL, Splunk SPL) for threat hunting.
Experience writing, testing, and auditing BC/DR documentation and participating in routine exercises.Experience in a regulated industry ([finance/healthcare/etc.]) with frameworks such as [SOC 2, ISO 27001, HIPAA, NIST CSF]

Communication & Collaboration

Strong written communication: ability to document procedures, write post-incident reports, and translate technical risk for legal, compliance, and executive audiences
Proven ability to partner with non-technical business units to balance security controls with operational productivity