Miami, FL

Cybersecurity Jobs in Miami, FL

21 jobs found

Include remote jobs

Today

Identity Security Engineer

Millennium Management Miami, FL

Miami, FL

Today

Full time Cloud Platforms Data Security Engineer

Apply Now

Job Description

Millennium Management is seeking an Identity Security Engineer to deliver consulting and engineering for identity security solutions and authentication platforms across on-premises and cloud environments. The role emphasizes modern authentication protocols, identity risk analysis, incident support, and moving security capabilities into production through automation.

Responsibilities

Provide security consulting and engineering for PingFederate, Entra ID, and related identity security solutions, supporting analysis, design, and development of new capabilities
Design, build, and maintain authentication platforms spanning on-premises and cloud environments
Engineer and support SAML, OpenID Connect, OAuth 2.0, and Kerberos authentication across identity providers, including single sign-on, PKI, and associated security controls
Assess identity management risks and deliver threat analyses and remediation plans for both technical and business stakeholders
Evaluate emerging security and privacy technologies, trends, and threats aligned to key business initiatives, then recommend approaches that inform the identity security roadmap
Support identity-focused workstreams during firmwide information security incidents, including containment, root-cause analysis, and post-incident hardening
Coordinate with Technology, Trading, Legal, Internal Audit, and Compliance teams to implement and enforce identity and access security policies
Transition solutions from engineering into production, maintain documentation and operational runbooks, and automate identity and access workflows using scripting and infrastructure as code

Requirements

5+ years of relevant technical experience, including 3+ years focused on information security; financial services experience is preferred
Bachelor’s degree in Computer Science, Engineering, or a related field
Experience with PingFederate and Entra ID
Experience managing IaaS and SaaS solutions and services through CI/CD pipelines
Strong understanding of modern authentication protocols and identity security controls
Experience with Microsoft 365 security controls
Experience implementing data loss prevention and Azure Information Protection, including data classification, labeling, encryption, and regulatory compliance
Familiarity with EDR, SIEM, vulnerability management, and relevant security certifications is a plus

Location

Miami, FL (onsite)

Technology Focus

PingFederate, Entra ID
SAML, OpenID Connect, OAuth 2.0, Kerberos
PKI, single sign-on
CI/CD, IaaS, SaaS, infrastructure as code
Microsoft 365 security controls
Data loss prevention, Azure Information Protection
EDR, SIEM, vulnerability management

View full job page →

19d ago

Alert, Detection, and Response Engineer, Associate

Blackstone Group Miami, FL

Miami, FL

19d ago

$110k - $170k/yr Full time Ai Security Cloud Threat Detection Crowdstrike

Apply Now

Job Description

Blackstone is hiring an Alert, Detection, and Response Associate for onsite incident response and detection engineering work in Miami, FL.

Responsibilities

Manage an incident queue from intake through investigation, containment, and closure across domains including email, endpoint, identity, network, and cloud
Own Tier 1 escalations by taking over complex investigations and bringing in additional responders as scope expands
Investigate security activity in the firm’s SIEM, writing and refining searches to pivot across endpoint, authentication, email, network, and cloud telemetry
Perform endpoint investigation and live response in the firm’s EDR, including process lineage review, persistence assessment, and artifact collection
Investigate email threats end to end, covering phishing, business email compromise, and malicious attachments and links
Use header and message trace analysis to determine who was targeted and drive remediation across impacted mailboxes
Investigate cloud and identity compromise, including credential misuse, role and privilege abuse, session hijacking, and multi-factor bypass
Scope suspected third-party and SaaS provider compromises by coordinating with the provider’s incident response team to confirm containment and affected Blackstone data
Independently hunt for provider indicators across endpoint, email, network, and cloud telemetry, coordinating findings and remediation with legal and compliance, vendor risk, and business owners
Serve as a core incident response team member: scope intrusions, drive containment and eradication, brief stakeholders, and escalate per the severity model
Turn investigation outcomes into detections by authoring and tuning detection logic, validating against historical and live data, moving through review into production, and confirming acceptable signal quality
Collaborate with agentic AI investigation tooling during first-pass triage and enrichment by evaluating outputs, escalating incorrect conclusions, and feeding back corrections to improve coverage
Help expand detection and response coverage as the firm increases use of AI across a fast-moving attack surface
Convert repeatable investigation and response work into durable automation to reduce repetitive steps and reduce false positives
Mentor Tier 1 analysts on investigation technique via case reviews and hands-on coaching
Document investigations and incidents with evidence handling and chain of custody practices, communicating clearly to technical teams and senior stakeholders
Contribute to threat hunts and purple team exercises, using red team activity and threat intelligence to identify gaps
Participate in incident response and SOC on-call rotation (occasional, roughly quarterly) to respond to escalated security incidents

Requirements

2+ years of hands-on experience in security operations, incident response, or a comparable technical security role
Proven ability to run end-to-end security investigations from alert through root cause, containment, and resolution in a SOC or incident response environment
Hands-on SIEM experience, including writing and troubleshooting queries; experience with a major enterprise SIEM and native query language (Splunk/SPL, Microsoft Sentinel/KQL, or Elastic)
Hands-on EDR experience performing endpoint investigation and containment using a leading EDR platform (CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint)
Working knowledge of cloud and identity investigation, including cloud audit logging, IAM, and SSO, plus identity providers such as Okta or Microsoft Entra ID
Practical understanding of attacker behavior across the intrusion lifecycle: phishing and business email compromise, credential theft, privilege escalation, lateral movement, persistence, and exfiltration
Familiarity with security technologies used in investigations, including email security, endpoint protection, proxies and firewalls, DLP, and vulnerability data
Working knowledge of MITRE ATT&CK and experience mapping observed activity to techniques
Experience scripting in Python and/or PowerShell for enrichment, parsing, and automating repetitive analysis
Hands-on experience using AI tooling in real work, with detailed examples and the judgment to identify untrustworthy outputs
Clear technical writing skills for explaining incidents and impact to both engineers and non-technical stakeholders
Ability to self-organize, prioritize under time pressure, and maintain accuracy during live incidents

Technologies

SIEM: Splunk/SPL, Microsoft Sentinel/KQL, Elastic
EDR: CrowdStrike, SentinelOne, Microsoft Defender for Endpoint
Identity: Okta, Microsoft Entra ID
MITRE ATT&CK, Python, PowerShell
AI tools and agentic AI investigation tooling
Email security, DLP, MFA bypass
SIEM correlation searches

Benefits

Comprehensive health benefits, including medical, dental, vision, and FSA
Paid time off
Life insurance
401(k) plan
Discretionary bonuses
Certain employees may be eligible for equity and other incentive compensation at Blackstone’s sole discretion

Preferred Qualifications

Detection engineering experience such as authoring or tuning SIEM correlation searches, EDR custom rules, or Sigma content, and measuring whether detections work
Detection-as-code experience, including Git-based workflows, peer review, and CI validation of detection content
SOAR automation experience with tools such as Torq, Splunk SOAR, or Tines
Digital forensics capability in memory, disk, or network analysis, or hands-on malware triage and sandboxing
Experience with agentic AI or LLM-assisted security tooling and AI security monitoring platforms
Threat hunting experience, especially hypothesis-driven hunts against endpoint or cloud telemetry
Working knowledge of at least one major cloud platform (AWS, Azure, or GCP) and how its logging, identity, and access services support investigations
Experience in financial services or another heavily regulated, globally distributed environment
At least one active security certification such as Security+, GCIH, GCFA, GCIA, GCED, CySA+, or a vendor SIEM certification
B.S. in Computer Science, Cybersecurity, Information Systems, or a related technical field

Compensation & Location

Location: Miami, FL (onsite)
Expected annual base salary range: $110,000 - $170,000
Minimum experience: 2 years

View full job page →

22d ago

Penetration Tester - Infrastructure & Red Team

Packetlabs Miami, FL

Miami, FL

22d ago

$90k - $130k/yr Full time Cloud Platforms Cybersecurity Tools Identity and Access Management

Apply Now

Job Description

Packetlabs offers a role for an ethical hacker who wants hands-on testing, real client impact, and room to grow. This position supports continued learning through paid education and professional development reimbursement, along with a flexible work environment designed to help you do your best work. You can also look forward to paid volunteer day, paid Birthday day off, and paid U.S. public holidays, with a compensation range of USD 90,000 to 130,000 per year (Remote within Texas or Florida, onsite in Florida).

What you’ll do

The Penetration Tester will plan, execute, and report on infrastructure penetration testing and adversary simulation work across enterprise environments. Engagements may cover on-premises, hybrid, and cloud systems, with testing that evaluates security controls by identifying, validating, and demonstrating exploitable vulnerabilities.

Plan and run infrastructure penetration testing engagements across on-premises, hybrid, cloud, wireless, and enterprise networks.
Conduct internal and external network penetration testing using manual methodologies and industry-standard offensive security tools.
Assess enterprise technologies including Active Directory, Microsoft Entra ID (Azure AD), Windows and Linux, virtualization platforms, cloud services, and supporting infrastructure.
Evaluate cloud environments across AWS, Microsoft Azure, and Google Cloud Platform to identify configuration weaknesses, privilege escalation opportunities, identity risks, and cloud security vulnerabilities.
Assess containerized environments, Kubernetes, and CI/CD pipelines where applicable.
Participate in and lead adversary simulation, red team, and objective-based engagements in line with established methodologies and client objectives.
Execute offensive security operations across the attack lifecycle, including reconnaissance, initial access, persistence, privilege escalation, credential access, lateral movement, defense evasion, command and control, and objective execution.
Support purple team efforts by collaborating with defensive teams to validate detections, improve monitoring capabilities, and strengthen defensive controls.
Develop attack scenarios that demonstrate realistic business impact while maintaining client system integrity.
Produce comprehensive technical reports covering vulnerabilities, attack paths, business impact, risk ratings, and remediation recommendations; present findings to technical and executive stakeholders.
Provide technical guidance on remediation strategies, security architecture, and defensive improvements, while managing engagement delivery quality, timelines, and client expectations.
Contribute to improving testing methodologies, internal tooling, technical documentation, and service offerings through research, automation initiatives, internal training, and knowledge-sharing.

Success in this role also includes contributing to technical research and collaborating with consulting teams to strengthen consistency and delivery across the Offensive Security practice.

What you bring

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related discipline; equivalent practical experience will be considered.
3+ years of professional experience performing infrastructure penetration testing, red teaming, adversary simulation, or offensive security consulting.
Demonstrated experience with enterprise infrastructure testing across Windows, Linux, Active Directory, Microsoft Entra ID, cloud platforms, and enterprise networking.
Experience with internal and external network penetration testing, privilege escalation, Active Directory security assessments, and lateral movement testing.
Experience assessing cloud environments including AWS, Microsoft Azure, or Google Cloud Platform.
Strong understanding of enterprise networking, authentication and identity management, cloud security, and offensive security methodologies.
Experience using industry-standard offensive security frameworks, tools, and tradecraft.
Excellent technical writing, presentation, and communication skills for technical and executive audiences.
Industry certifications such as OSCP, OSEP, CRTO, CRTE, CARTP, CARTA, CREST CRT, CREST CCT, PNPT, GPEN, GXPN, or equivalent are an asset; OSCP or equivalent demonstrated technical capability is strongly preferred.
Experience in red team, purple team, adversary simulation, or threat emulation is an asset.
Customer-first mentality with rapid responses and on-time delivery.
Commitment to validating impact, curiosity to dig deeper into findings, and comfort working through obstacles in a consulting environment.
Self-motivated, dependable, and humble working style.

Technologies you’ll work with

Active Directory, Microsoft Entra ID (Azure AD), Windows, Linux, virtualization platforms, cloud services, AWS, Microsoft Azure, Google Cloud Platform, Kubernetes, CI/CD pipelines, offensive security frameworks, adversary simulation, red team, purple team, and threat emulation.

How success is measured

Delivery of infrastructure penetration testing and adversary simulation engagements within established quality, budget, and timeline expectations.
Accuracy, completeness, and technical quality of reports and deliverables.
Demonstrated expertise across enterprise infrastructure, cloud security, Active Directory, and offensive security methodologies.
Positive client feedback on technical expertise, communication, and professionalism.
Contributions to technical research, methodology development, automation, and knowledge-sharing.
Effective collaboration with Delivery Managers, Project Managers, and consulting team members.
Ongoing professional development through certifications, research, and continuous technical skill advancement.

View full job page →

22d ago

Penetration Tester - Hardware

Packetlabs Miami, FL 🇺🇸 Remote

Miami, FL

22d ago

$80k - $120k/yr Full time Cybersecurity Tools Embedded Firmware Embedded Iot Security

Apply Now

Job Description

This remote Penetration Tester - Hardware role at Packetlabs focuses on leading security assessments of embedded and IoT devices, combining hands-on physical testing with rigorous analysis to produce credible, actionable results for clients.

Location

Florida (remote)

Salary

USD 80,000 - 120,000 per year

Role Summary

In this position, you will plan and execute end-to-end hardware penetration testing across embedded and IoT environments. Responsibilities include direct interaction with embedded hardware, firmware analysis, and examination of physical attack surfaces. You will collaborate with clients to deliver findings that improve overall security posture.

Key Responsibilities

Plan and execute end-to-end hardware penetration tests on embedded and IoT devices, aligned to a defined scope and rules of engagement
Identify, access, and exploit on-board debug interfaces such as JTAG, SWD, UART, and similar interfaces to gain code execution or memory access
Extract firmware via debug ports, in-circuit flash reads (SPI / I2C / NAND), or chip-off when required, then analyze for vulnerabilities
Intercept and analyze data on embedded buses including SPI, I2C, UART, CAN, and USB using logic analyzers and protocol decoders
Where in scope, perform side-channel analysis and fault injection such as power analysis and voltage or clock glitching to bypass secure boot, readout protection, or authentication
Reverse engineer firmware and embedded binaries using tools such as Ghidra, IDA, and Binwalk to identify logic flaws, hardcoded secrets, and exploitable conditions
Assess physical attack surface, tamper resistance, and key or secret storage
Differentiate theoretical concerns from operationally relevant risk to keep reports actionable
Produce high-quality technical reports and present results to both technical and non-technical client stakeholders
Advise clients on practical, prioritized remediation they can act on
Build and maintain lab tooling, test rigs, and internal methodology
Contribute to research, responsible disclosure, and internal knowledge-sharing
Stay current on hardware attack techniques, embedded architectures, and defensive controls
Help raise the standard of hardware security work across the firm

Required Education and Experience

Graduate of an Information Security, Computer Science, or Computer/Electrical Engineering degree program (or equivalent hands-on experience)
Strong electronics fundamentals, including the ability to read schematics and datasheets and reason about a board from them
Hands-on soldering capability, including SMD rework and basic chip removal
Demonstrated experience accessing debug interfaces (JTAG, SWD, UART) and extracting firmware from real devices
Comfort using core bench instruments including a logic analyzer, oscilloscope, and multimeter
Firmware reverse-engineering skills with scripting proficiency in Python, plus enough C to read embedded code
Familiarity with embedded architectures including ARM/Cortex-M, MIPS, AVR, and RISC-V, as well as RTOS and bare-metal concepts
Clear written and verbal communication

Technologies

JTAG, SWD, UART, SPI, I2C, NAND, CAN, USB
Logic analyzers, protocol decoders
Ghidra, IDA, Binwalk
Python, C
ARM/Cortex-M, MIPS, AVR, RISC-V
RTOS, bare-metal
KiCad, Altium
ChipWhisperer, SDR, BLE, Wi-Fi

Benefits

Immediate and ongoing offensive security training, mentorship, and professional development
Competitive compensation and growth opportunity
Paid education and professional development reimbursement to support continued learning, certifications, and technical growth
Flexible work environment
Paid volunteer day each year
Paid Birthday day off
Paid U.S. public holidays
Fully remote within Texas or Florida

Location Requirement

You must be located in Texas or Florida

Nice to Have

Side-channel or fault-injection experience (for example, ChipWhisperer)
RF and wireless work, including SDR, BLE, sub-GHz, or Wi-Fi
Knowledge of secure boot chains, TEEs, secure elements, and HSMs
PCB design familiarity (KiCad / Altium) for understanding target boards
Published CVEs, conference talks, CTF placements, or open-source tooling
Relevant certifications (for example, OSCP for breadth, or hardware-focused training)

What Success Looks Like

Clients gain a clear, accurate understanding of hardware risk with proven, reproducible impact
Findings are credible and actionable for both technical and leadership audiences
Engagements are delivered at a consistently high standard with strong client confidence
Scope and rules of engagement are managed well as engagements evolve, with risk surfaced early and clearly
Packetlabs' hardware testing methodology and lab capability continue to mature through your contribution
Clients trust Packetlabs as the partner that can break hardware before others do

View full job page →

22d ago

Penetration Tester

Packetlabs Miami, FL 🇺🇸 Remote

Miami, FL

22d ago

Full time Api Security Application Security Burp Suite

Apply Now

Job Description

Packetlabs is hiring a Penetration Tester for expert-level application security testing across multiple platforms.

Responsibilities

Conduct penetration testing across web applications, mobile applications, thick clients, and APIs.
Perform source code review and whitebox penetration testing to demonstrate real impact from application flaws.
Carry out reverse engineering of mobile and thick client applications.
When applicable, chain weaknesses to other environments, including cloud and on-prem AD infrastructure.
Run SAST and DAST on enterprise, SaaS, and custom in-house applications.
Use security scanners and apply validation/elimination techniques for false positives.
Develop detailed findings documentation, including remediation-focused reports for both technical and executive audiences.
Debrief testing results at both technical and executive levels.
Apply an OWASP-informed approach across Web, API, Mobile, and AI/LLM.

Requirements

Customer-first mentality.
Strong communication skills with clients, project managers, and teammates.
Ability to respond quickly and deliver work on time.
Take pride in the quality of delivered results.
Dig deeper into findings and continue testing until impact is proven.
Comfort working through challenges and obstacles, not avoiding them.
Experience adapting to a consulting-style environment with rapidly changing needs.
Ongoing learning mindset, with awareness of your own skillset and willingness to improve.
Self-motivated and dependable.
Humble team approach; egos are not a fit for Packetlabs.
Solid working knowledge of programming languages including: C, C#, Python, Objective-C, Java, JavaScript, SQL, and AngularJS.
Familiarity with web services and data formats including: XML, JSON, SOAP, REST, AJAX.
Understanding of AI/LLM weaknesses and flaws in applications.
Extensive experience using an attack proxy such as Burp Suite.
Professional qualifications (one or more): OSCP, OSWE, BSCP.
OSCP or Burp is mandatory for this organization.
Must be located in Florida.
Minimum experience: 3 years.
Education: graduate of a post-secondary college or university degree program.

Technologies

C, C#, Python, Objective-C, Java, JavaScript, SQL, AngularJS
XML, JSON, SOAP, REST, AJAX
Burp Suite, SAST, DAST
OSCP, OSWE, BSCP
OWASP

Benefits

Competitive compensation and growth opportunity
Paid education and professional development reimbursement for certifications and technical growth
Flexible work environment
Paid volunteer day each year
Paid Birthday day off
Paid U.S. public holidays
Fully remote within Texas or Florida

Additional Notes (At-Will Employment)

This position is at-will. This job posting does not constitute an employment contract or guarantee of continued employment.

View full job page →

27d ago

Cyber Security Engineer

Banco de Credito e Inversiones Miami, FL

Miami, FL

27d ago

Full time Ai Security Blue Teaming Cloud Platforms

Apply Now

Job Description

Banco de Credito e Inversiones is seeking a hands-on Cyber Security Engineer to join its Information Security team in Miami, FL (onsite). In this role, you will help safeguard digital assets, sensitive customer data, and internal systems while strengthening enterprise defenses across endpoint, network, email, and cloud environments.

The position focuses on leading patch management, maintaining core security platforms, and driving continuous vulnerability and threat monitoring. Work will be aligned to the NIST Cybersecurity Framework and relevant banking regulations, with responsibilities that include incident response and control validation through red and blue team exercises.

Key Responsibilities

Lead enterprise patching by planning, testing, scheduling, and executing patch deployments across endpoints, mobile devices, servers, and network infrastructure, with an emphasis on rapid, proactive remediation to reduce attack surface.
Perform continuous vulnerability scans and assessments, prioritize risks, and coordinate with IT teams to drive remediation before vulnerabilities are exploited.
Establish, document, and enforce baseline security hardening standards across enterprise assets and systems.
Monitor security event logs for suspicious activity, anomalies, and potential breaches. Continuously update detection logic to stay ahead of emerging AI threats such as automated phishing, adversarial machine learning, and deepfake social engineering.
Support red and blue team (purple teaming) exercises to validate security control effectiveness, identify gaps, and tune alerting systems based on simulated real-world attacks.
Lead incident investigation and containment during high-impact security events.
Oversee the implementation, configuration, and daily operations of Endpoint Detection and Response (EDR), Anti-Virus, DLP, and device access controls.
Provide hands-on management for critical security platforms, including Security Email Gateways, IPS/IDS, and database security controls.
Support secure configuration and continuous security monitoring for cloud environments including AWS, Azure, SaaS, and Office 365 in alignment with industry frameworks.
Ensure technical controls, architectures, and operational procedures map to NIST CSF and NIST SP 800-53, demonstrating a high-level understanding of banking regulations such as FFIEC, GLBA, and FINRA.
Enforce security policies, maintain network/architecture diagrams, and support standard operating procedures (SOPs). Assist internal and external auditors during security reviews.

Required Qualifications

English and Spanish ability: understand, speak, read, and write.
Ability to speak effectively before groups of customers or employees.
Capacity to assume evolving duties and responsibilities as the position changes.
Willingness to work all hours required, including weekends, evenings, and holidays as needed.
Travel as required, and provide coverage for other positions when requested.
Ability to carry and lift boxes and objects weighing 10 to 25 pounds.
Perform additional duties and responsibilities assigned by management.
Ability to operate IBM compatible personal computers, and fluency with Microsoft Word, Microsoft Excel, and Microsoft PowerPoint.

Technologies and Frameworks

NIST Cybersecurity Framework (CSF), NIST SP 800-53, FFIEC, GLBA, FINRA
EDR, Anti-Virus, DLP
Security Email Gateways, IPS/IDS, database security controls
AWS, Azure, Office 365
Microsoft Word, Microsoft Excel, Microsoft PowerPoint
Python, Bash, PowerShell
LLMs and artificial intelligence, including automated phishing, adversarial machine learning, and deepfake social engineering

Certifications (Core Security)

CISSP, CISA, OSCP, CHFI, or CISM

Certifications (Operations & Cloud)

CCSP, AWS Certified Security, Azure Security Engineer, or Google Secops

Experience and Background

Strong mindset for proactive remediation and vulnerability lifecycle management, with in-depth understanding of enterprise patch deployment processes.
Working knowledge and practical experience implementing the NIST Cybersecurity Framework.
Familiarity with red and blue teaming methodologies and translating offensive findings into defensive engineering improvements.
Up-to-date awareness of emerging AI threats and how LLMs and artificial intelligence are changing the threat landscape.
Proven experience configuring and supporting EDR tools, Firewalls, Secure Email Gateways, and vulnerability scanners.
Proficiency with Python, Bash, or PowerShell for automation and task execution.
Excellent verbal and written communication skills, with the ability to explain regulatory and technical concepts to non-technical business partners.

Minimum Experience and Education

Minimum experience: 3 years
Education: Degree in Information Security, Computer Science, Software Engineering, Management Information Systems, or practical bac

View full job page →

2mo ago

Cybersecurity Engineer

HB Mechanical Group, LLC Miami, FL

Miami, FL

2mo ago Closed

Full time Cloud Platforms Cybersecurity Tools Endpoint Security

This position is no longer accepting applications (closed Sep 12, 2026).

Job Description

HB Mechanical Group, LLC is hiring a dedicated Cybersecurity Engineer to own hands-on security operations and engineering across the enterprise. This is a role built for someone who can translate security strategy into working, managed controls, partnering with internal admins and external vendors to keep protections effective across multiple divisions.

Work model: hybrid Remote–On Site. Candidates within driving distance of the HB Mechanical Group office in Camp Hill, PA or the Tamarac, FL office are preferred. Strong candidates residing in the U.S. Eastern time zone will be considered. Hours may vary based on business needs, with occasional travel between HB Global offices and divisional worksites. On-call availability for security incidents and urgent requests is required.

Responsibilities

In this role, you will be the day-to-day owner of threat detection and response, detection tuning, and security control operations across the stack. Key duties include:

Conduct day-to-day threat hunting, monitoring, and alert triage across the CrowdStrike Falcon platform (EDR, NG-SIEM, and Identity Threat Protection).
Investigate, contain, and remediate security incidents end to end, including root-cause analysis and documenting findings and lessons learned.
Tune detections, correlation rules, and alerting to reduce noise and improve fidelity.
Monitor and respond to email-borne threats and user-reported phishing using Mimecast, including quarantine management and policy tuning.
Implement, configure, and maintain security controls across Microsoft Azure and on-premises systems, coordinating with third-party architects when required.
Administer identity and access security across Microsoft Entra ID / Active Directory, Okta, Microsoft 365, and Google Workspace, enforcing least privilege, MFA, and conditional access.
Own endpoint protection and DNS-layer security using Cisco Umbrella, and support network security policy on Cisco Meraki in partnership with the Senior Network Administrator.
Own vulnerability management, including scanning, prioritization, and coordinating remediation within the IT team.
Partner with the Senior Systems Administrator to validate and test backup integrity and participate in disaster-recovery testing for tools administered by that role (Druva, Veeam).
Manage secrets and password platform 1Password and champion strong credential hygiene across the organization.
Maintain security configuration standards and hardening baselines aligned to leadership strategy.
Plan, track, and report on security initiatives using Zoho Projects.
Manage day-to-day relationships with security vendors and managed-service providers and hold third parties accountable to deliverables.
Own the Mimecast security-awareness program, including quarterly awareness trainings, quarterly phishing simulations, and progress/completion reporting.
Produce clear, regular reporting on overall cybersecurity posture for leadership and executive audiences, translating technical detail into concise summaries.
Pull and correlate data from the security stack (CrowdStrike, Mimecast, Cisco Umbrella and Meraki, identity, and vulnerability tools) into reports and dashboards.
Define and track key security metrics and KPIs (detection and response times, vulnerability remediation, patch status, phishing-test results) and report trends over time.
Provide on-demand snapshots of security state and communicate risks, priorities, and recommendations to non-technical stakeholders.
Support multiple semi-autonomous divisions with consistent enterprise standards and governance while adapting to each division’s operational needs.
As HB Global grows, onboard and standardize security controls for new business units to the HB Global baseline.
Assess security posture of incoming environments and build plans to consolidate identity, endpoint, email, network, and backup protections.
Support compliance, audit, and cyber-insurance requirements with clear evidence and documentation.
Partner with leadership to turn security strategy into hands-on execution and flag emerging risks and priorities.
Provide backup and cross-coverage for network security controls alongside the Senior Network Administrator.
Perform other duties as assigned.

Requirements

5+ years of hands-on experience in cybersecurity engineering, security operations, or a blended security/IT role.
Proven ability to build and operate security controls with minimal supervision as a security generalist.
Hands-on experience with EDR/endpoint security and SIEM (CrowdStrike strongly preferred).
Strong identity and access management experience (Entra ID / Active Directory, Okta, MFA, conditional access).
Experience securing Microsoft 365 and cloud environments (Microsoft Azure).
Practical incident-response and threat-hunting experience, including solid networking and firewall fundamentals.
Experience working with outside security vendors/managed services and coordinating deliverables to timelines and quality expectations.
Working knowledge of security frameworks and best practices (e.g., NIST Cybersecurity Framework, CIS Controls) and the ability to enforce data/access security policies.
Scripting and automation ability (PowerShell and/or Python) for routine tasks and tool integrations.
Strong analytical and problem-solving skills with clear communication to both technical and non-technical stakeholders.
Ability to pull data from multiple security platforms and present security posture in clear reports and dashboards for executive audiences.
Extensive knowledge of Microsoft Entra ID / Active Directory, Microsoft 365, and Azure security.
Familiarity with email security, DNS security, and backup/disaster-recovery concepts.
Familiarity with confidentiality requirements related to IT operations and network information.

Technologies

CrowdStrike Falcon (EDR, NG-SIEM, Identity Threat Protection)
Mimecast
Microsoft Azure; Microsoft Entra ID; Active Directory; Microsoft 365; Google Workspace
Okta; least privilege; MFA; conditional access
Cisco Umbrella; Cisco Meraki
Vulnerability management
Druva; Veeam
1Password
Zoho Projects
PowerShell; Python
NIST Cybersecurity Framework; CIS Controls
CISSP; SSCP; CompTIA Security+; CompTIA CySA+; GIAC (GCIH, GCIA)

Education

High School Diploma
BA/BS in Information Technology, Computer Science, Cybersecurity, or equivalent experience
Relevant security certifications and continuing education preferred

Preferred Qualifications

Industry certifications such as CISSP, SSCP, CompTIA Security+/CySA+, GIAC (GCIH, GCIA), or CrowdStrike / Microsoft Azure security certifications.
Direct experience with the stack: CrowdStrike, Mimecast, Cisco Meraki, Cisco Umbrella, Druva, Veeam, Google Workspace, Okta, and 1Password.
Experience standardizing security across multiple sites or business units within a growing, multi-entity organization.
Experience integrating or supporting newly added business units.
Experience in a multi-division or federated IT/security environment.