Cyber Security Engineer

Position summary

The Cyber Security Engineer will be accountable for building, operating, and improving the company’s security controls and protection stack. This role focuses on safeguarding the confidentiality, integrity, and availability of systems and data by detecting threats, handling incidents, reducing vulnerabilities, and applying strong security practices throughout the IT landscape.

Core duties

• Keep watch over security platforms including SIEM, EDR/XDR, firewalls, IDS/IPS, and email protection tools.
• Review, interpret, and act on alerts, suspicious behavior, and possible security events.
• Investigate incidents and escalate high-severity issues when needed.
• Help refine detection logic, use cases, and alert tuning to improve response quality.
• Run vulnerability assessments on a routine basis and coordinate corrective actions.
• Identify and rank security risks across servers, endpoints, applications, and network equipment.
• Work with infrastructure and application teams to close vulnerabilities promptly.
• Monitor remediation status and prepare risk-based updates and reports.
• Install, configure, and support cybersecurity tools and related technologies.
• Manage endpoint defense, DLP, MFA, VPN protection, web filtering, and access control systems.
• Keep security tools patched, optimized, and working as intended.
• Assess new products and recommend better-fit security technologies where appropriate.
• Take part in incident response work such as triage, containment, eradication, and recovery.
• Perform root cause analysis and record the findings from incidents.
• Assist with digital forensic reviews when required.
• Maintain incident response procedures, runbooks, and playbooks.
• Apply hardening standards across servers, workstations, network devices, and cloud resources.
• Support secure baselines and system patching workflows.
• Partner with IT teams to embed security into design and operational processes.
• Contribute to Zero Trust and defense-in-depth initiatives.
• Support identity and access management activities, including privileged access and role-based access.
• Review user permissions to confirm adherence to least-privilege principles.
• Assist with MFA, SSO, and identity governance controls.
• Support compliance with internal policies, standards, and applicable regulatory requirements.
• Assist in audits, control assessments, and review activities.
• Participate in risk assessments and help define mitigation plans.
• Maintain evidence and records needed for compliance and audit work.
• Support security awareness efforts and promote safe cyber practices.
• Document tools, procedures, configurations, and incident records accurately.
• Create technical documentation, runbooks, and standard operating procedures.
• Share knowledge with IT colleagues and assist junior security staff when needed.

Qualifications and experience

A bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related discipline is preferred. The role requires at least 3 years of experience in cybersecurity, information security, or security engineering. Candidates should have practical exposure to SIEM, EDR, firewalls, IDS/IPS, vulnerability scanners, and email security gateways, along with hands-on involvement in incident response, vulnerability management, and security monitoring. Experience securing on-premises and/or cloud environments is also expected.

Skills and competencies

Strong knowledge of cyber defense principles and industry best practices is essential, along with a solid understanding of network security, endpoint protection, system security, and identity management. Familiarity with TCP/IP, DNS, VPN, routing, switching, and common attack techniques is important. The role also calls for the ability to analyze logs, alerts, and incidents effectively, plus working knowledge of Windows and Linux security and Active Directory environments. Excellent troubleshooting, analytical thinking, communication, documentation, and teamwork skills are required.

Certifications

Optional but useful certifications include CompTIA Security+, CEH (Certified Ethical Hacker), CySA+, SC-200, SC-300, AZ-500, and vendor-specific certifications from Fortinet, Palo Alto, or similar providers.

Key attributes

The ideal candidate is proactive, detail-oriented, and security-conscious, with the ability to stay calm under pressure during incidents. A strong sense of accountability, a continuous-learning mindset, and a practical, solution-focused approach are important for success in this role.

Working conditions

This position may require on-call support or flexible hours to handle incidents and critical security events. After-hours maintenance or emergency response work may also be needed. The role is primarily office-based, although hybrid or remote support may be possible depending on business requirements.