Security Operations Engineer
The Opportunity
The Security Operations Engineer is responsible for executing and operating enterprise cybersecurity functions across Richline Group subsidiaries. Reporting to the Senior Cybersecurity Analyst / Cybersecurity Lead, this role focuses on vulnerability management, patch coordination, security monitoring, endpoint security, and incident response execution. The position supports a unified cybersecurity stack and works corporately across locations, with a strong emphasis on Microsoft Windows enterprise environments.
What You'll Do
Vulnerability & Patch Management
- Operate enterprise vulnerability scanning and patch management platforms.
- Support risk-based patch schedules, remediation priorities, and vulnerability service-level targets across subsidiaries.
- Coordinate remediation activities with Network, Systems, and Endpoint Administrators.
- Track remediation progress, validate closure, and produce vulnerability and patch compliance reporting.
- Support vulnerability exception handling in coordination with GRC and cybersecurity leadership.
Security Monitoring, EDR & Alert Triage
- Monitor and investigate security alerts from SIEM, MDR, EDR/XDR, IDS/IPS, cloud security, and related enterprise security technologies.
- Perform first-level investigation and triage, identify false positives, document findings, and escalate validated issues when additional action is required.
- Perform day-to-day operational tasks within enterprise endpoint detection and response platforms, including alert review, endpoint investigation, containment support, and policy-related administration under approved standards.
- Support tuning and continuous improvement of security monitoring and detection capabilities.
Incident Response Execution
- Execute incident response activities such as evidence collection, endpoint isolation, containment, remediation support, and documentation.
- Maintain incident timelines, investigation notes, and supporting evidence.
- Support post-incident reviews and corrective action tracking.
Cloud, Web & Internet-Facing Security
- Support the operation and monitoring of cloud and internet-facing security controls, including web application firewalls (WAF), bot management and detection, application and API protection, traffic filtering, and related threat-prevention technologies.
- Assist with investigation of suspicious web, application, and cloud activity and coordinate remediation or escalation as required.
- Support security controls across cloud-based and hybrid enterprise environments.
Security Tool Operations & Automation
- Perform day-to-day operational management of cybersecurity tools under approved designs, policies, and standards.
- Support SOAR playbook execution, workflow automation, and operational security process improvements.
- Maintain documentation, operational procedures, and technical runbooks for assigned security technologies.
Collaboration & Reporting
- Work closely with IT Operations, GRC, application teams, and external security providers to coordinate security activities and remediation.
- Provide operational metrics, findings, and status reporting to cybersecurity leadership.
- Participate in security reviews, incident exercises, and continuous improvement initiatives.
What You'll Need
- 3-5 years of hands-on experience in security operations, infrastructure security, SOC operations, or a related cybersecurity role.
- Strong working knowledge of enterprise Microsoft Windows environments, including Windows endpoints, Windows Server, Active Directory, patching, authentication, and security hardening concepts.
- Hands-on experience working with enterprise EDR/XDR platforms, including alert investigation, endpoint activity review, containment, and remediation support.
- Experience with vulnerability management and enterprise patch management, including vulnerability review, risk-based prioritization, remediation tracking, and validation.
- Experience with SIEM and security monitoring platforms, including alert triage, log analysis, investigation, documentation, and escalation.
- Working knowledge of incident response processes and security investigation practices.
- General understanding of cloud and internet-facing security controls such as WAF, application protection, bot protection, API security, and cloud security technologies.
- Strong analytical, troubleshooting, documentation, and communication skills.
Preferred
- Experience with proactive threat hunting using EDR/XDR technologies and endpoint telemetry is highly desirable.
- Experience administering enterprise email security platforms and related modules, including phishing and malware protection, URL and attachment analysis, data loss prevention, and cloud/SaaS security capabilities, is a plus but not required.
- Experience with SOAR, security automation, or playbook development is a plus.
- Experience supporting security in Microsoft cloud or hybrid environments is preferred.
- Experience with network security technologies such as firewalls, IDS/IPS, DNS/web security, segmentation, or network traffic analysis is beneficial.
Education & Certifications
- Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical field preferred, but not required.
- Relevant cybersecurity, information technology, or security operations training is preferred.
- Industry-recognized cybersecurity certifications such as CompTIA Security+, CySA+, SSCP, GSEC, or equivalent are preferred.
- Specialized training or certifications in endpoint security/EDR, SIEM, vulnerability management, incident response, Microsoft security technologies, cloud security, or threat hunting are a plus.
- Relevant hands-on experience and technical training may be considered in evaluating a candidate's overall qualifications.
Role Scope
- This is an individual-contributor role and does not include direct people-management responsibilities.
- The role executes and operates cybersecurity controls but does not independently own enterprise security architecture decisions.
- The role works in partnership with IT Operations and does not replace IT Operations leadership or infrastructure ownership.
Reporting & Collaboration
- Reports to the Senior Cybersecurity Analyst / Cybersecurity Lead.
- Works closely with IT Operations, GRC, application teams, and managed security service providers.
- Escalates complex investigations, major incidents, and security architecture decisions to senior cybersecurity leadership as appropriate.
Location
- New Mexico or Florida-Hybrid
Salary
The Company:
Richline Group, a Berkshire Hathaway company, is a global leader in precious metals, jewelry, and related products. Through our business units, including LeachGarner, Richline Jewelry, Rio Grande, and Inverness, we serve customers worldwide through manufacturing, distribution, and innovative sourcing solutions. We are committed to operational excellence, responsible sourcing, and long-term customer partnerships.
Compensation
For U.S. locations that require the disclosure of compensation, the pay range for this position is $75,000 - $85,000. Please keep in mind that this range is base pay only and does not include other components of the total rewards package for the position. If you are hired at Richline Group, Inc., your overall compensation will be determined based on factors such as skills, education, and/or experience, which may result in total compensation outside of this range.
EEO Statement
We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender, gender identity or expression, or veteran status. We are proud to be an equal opportunity workplace.
Richline does not accept resumes from recruiters or suppliers with which it has not signed a formal fee agreement. Suppliers are determined by specific hiring needs. Therefore, any resume received from an unapproved supplier is unsolicited, and Richline Group, Inc. is not obligated to pay referral fees.