Information Security Engineer

Role OverviewAs an Information Security Engineer, you will be responsible for guiding clients through complex security programs, managing compliance frameworks such as SOC 2 and ISO 27001, and directly implementing security controls in cloud, endpoint, and identity environments. You will serve as the technical authority on cybersecurity operations, vulnerability management, and security architecture, ensuring the protection of client assets and data integrity.Key ResponsibilitiesLead clients through SOC 2, ISO 27001, and NIST CSF audits, including readiness assessments, remediation, and evidence collectionDevelop and maintain security policies aligned with industry standards such as NIST, GDPR, CCPA, and SEC regulations, covering incident response, access management, acceptable use, BCDR, and privacyOversee internal compliance programs using automated tools like Vanta, and execute compliance roadmaps aligned with client growth and fundraising milestonesEvaluate vendors and AI tools for security risks, maintain vendor inventories, risk tiers, and attestations, and optimize TPRM proceduresDeploy, configure, and manage endpoint detection and response (EDR) solutions (SentinelOne), and mobile device management (MDM) platforms (Jamf, Mosyle, Intune) across Mac and Windows devicesStrengthen identity and access management using Okta, Entra ID, MFA, and password managers such as 1PasswordHarden security posture of cloud-based platforms including Google Workspace, Microsoft 365, and major cloud providers, implementing best practices for SaaS and IaaS environmentsMonitor, triage, and respond to security alerts from endpoint, email, identity, and cloud sources; lead incident response and post-incident analysisManage vulnerability scans, conduct pen testing, and administer SIEM tools; perform access reviews and configuration auditsConduct security awareness training, phishing simulations, and client security workshops to elevate security maturityScope and lead security projects, manage timelines, and document standard operating procedures and Playbooks for operational consistencyCore Qualifications & Requirements3 to 5+ years of experience in information security, cybersecurity, or IT with a focus on security operations and complianceProven experience leading full security audits utilizing Vanta, Drata, or Secureframe platformsHands-on administration of endpoint detection and response (EDR) and mobile device management (MDM) toolsStrong knowledge of identity and access management systems (Okta, Entra ID) and cloud security practices for Google Workspace, Microsoft 365, and public cloud platformsExperience managing vulnerability programs, conducting incident response, and leading security remediation effortsThorough understanding of SOC 2, ISO 27001, NIST CSF frameworks, and security policy developmentNice-to-Have QualificationsSecurity+, CISSP, CISA, or ISO 27001 Lead Implementer certificationsConsulting, MSP, or security advisory backgroundExperience with SEC Regulation S-P, SOX ITGC, IPO readiness, or governance frameworksRisk assessments for AI tools and scripting knowledge in Python, PowerShell, or BashCore Technical SkillsEDR: SentinelOne, CrowdStrike, Carbon BlackMDM Platforms: Jamf, Mosyle, IntuneIdentity & Access Management: Okta, Entra ID, MFA solutionsCloud Security: Google Workspace, Microsoft 365, AWS, Azure, GCPSecurity Frameworks: SOC 2, ISO 27001, NIST CSFVulnerability Management & SIEM: Qualys, Nessus, Splunk, ElasticCareer ImpactThis role provides the opportunity to shape and lead security initiatives for innovative technology companies, ensuring robust risk mitigation and compliance at scale while working within a fast-paced, evolving cybersecurity environment.Compensation and BenefitsSalary range: Competitive based on experience, plus performance-based bonuses. Comprehensive health benefits, flexible PTO, professional development stipends, and remote work options available.