Security Engineer

Job Description

Requirements
- -----------

### Must have:

### - We require a Bachelor of Science degree in a relevant field such as computer science, computer languages, or a closely related discipline, or an equivalent mix of education and progressive related experience. - We strongly prefer professional certifications such as Security+, PenTest+, GIAC security credentials, Microsoft security certifications, SSCP, or CISSP. - We need at least 5 years of extensive experience in threat hunting and security forensics. - We require 3+ years of hands-on experience with the Microsoft Defender Security Stack, including XDR, MDR, Endpoint, Identity, Cloud Apps, Office 365, and Sentinel. - We require 3+ years of experience with identity management tools and controls, including Entra ID, Active Directory, and Conditional Access. - We expect working knowledge of Intune and Group Policy configuration management. - We require experience supporting MFA environments, including Microsoft and Duo. - We need practical technical knowledge of Windows OS hardening, perimeter defenses, firewall services, and web application firewalls; PAN expertise is a plus. - We expect strong understanding of cloud computing standards, with Azure preferred. - We require solid knowledge of IP, TCP/IP, and other core network administration protocols. - We value a strong grasp of security awareness training needs. - We prefer familiarity with NIST, CIS, PCI, and DSS standards. - The successful candidate must reside in California and be within commuting distance of San Francisco for hybrid work. - We are not able to offer relocation assistance or employment visa sponsorship at this time.

Responsibilities:
- ----------------

- We oversee the day-to-day administration and monitoring of our existing security solutions. - We identify, investigate, and resolve security incidents and alerts detected by our tools. - We contribute to the planning and design of our enterprise security architecture under the guidance of our Director of Security. - We help develop and maintain security policies, standards, baselines, guidelines, and procedures. - We stay current on emerging threats, evolving attack methods, and new or improved security technologies. - We recommend enhancements and additional controls to strengthen our overall security posture. - We deploy, integrate, and configure new security tools and upgrades in line with operating procedures and internal security documentation. - We maintain secure configuration baselines for devices and systems under our control and across the broader environment. - We manage the operational setup of our security solutions to ensure reliable and effective performance. - We continuously monitor security platforms to confirm proper and efficient operation. - We deliver security awareness training and phishing simulation exercises. - We review logs and system reports, assess the implications of activity, and determine appropriate remediation steps. - We assist with investigations into suspicious or problematic activity and analyze trends. - We participate in vulnerability assessments, penetration tests, and security audits. - We provide on-call support as needed.
- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Company:
- -------

We are the Workers Compensation Insurance Rating Bureau of California, a stable, long-standing, private nonprofit association serving Californias workers compensation insurance industry with actuarially based information, research, advisory pure premium rates, and educational services. Our organization is funded through membership fees and assessments rather than state funding, and we are recognized as a proven national leader in our field. We employ about 175 people with an average tenure of more than 10 years, and we are committed to building a healthy, safe, diverse, collaborative, and innovative workplace. This is a hybrid role based in San Francisco, with approximately 40% of work time spent onsite. We offer a modern open office environment and a strong benefits package that includes medical, dental, and vision coverage, competitive paid time off, wellness support, 401(k) and pension plans, social activities, and community volunteer opportunities.
- -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------