LTG - Security Engineer II

The Security Engineer II implements and operates the security controls that protect the organization's technology environment. The role works across the security products the Enterprise Security Office runs, with the heaviest day-to-day work in cloud and network environments.    This is a hands-on role. The Security Engineer II builds what senior and staff engineers design, handles day-to-day configuration, tuning, and troubleshooting of assigned security products, works requests from IT and business teams, and takes part in an on-call rotation. The role is a place to build depth across the security toolset with senior engineers close by.      Principal Duties and Responsibilities:  Engineering and Implementation:  Implement and maintain security controls across cloud and on-premises environments, including identity and access configuration, network segmentation, firewall and platform policy, logging, and key and secret management.  Build and configure what senior and staff engineers design, then test and validate the change before it reaches production.  Support deployments, upgrades, and migrations of security platforms, including version updates, failover testing, license renewals, and configuration backups.  Onboard log sources into the SIEM and confirm they keep reporting.  Write small scripts to automate repetitive configuration, validation, and reporting work.  Review system and resource configurations against the organization's security baselines and report drift to the owner.  Operations and Support:  Handle day-to-day configuration, tuning, and troubleshooting of assigned security products.  Respond to security service requests and tickets within the team's service levels.  Triage alerts and findings, separate false positives from real issues, and work with system owners through remediation.  Troubleshoot problems that involve a security control, working with infrastructure and application teams to separate a policy issue from a routing or application issue.  Participate in a rotating on-call schedule for security platform issues and security incidents, including nights, weekends, and holidays.  Support the Security Incident Response Team during investigations with log retrieval, evidence collection, and containment actions under the direction of a senior engineer or incident commander.  Escalate early when a problem is outside the scope of the role or carries risk beyond a routine change.  Collaboration and Documentation:  Follow change management: document the change, test it, and get approval before it goes to production.  Write and update product documentation, including configuration notes, runbooks, access instructions, and change records.  Explain a control or a finding to a system owner who does not work in security, and say what the owner needs to do next.  Take part in design and peer reviews, and bring questions and observations from day-to-day operations.  Support security reviews of new services and tools before they are approved for use.

Bachelor's degree in Computer Science, Cybersecurity, Engineering, or related field, or equivalent practical experience.

1 - 3 years of experience in security engineering, network engineering, systems administration, or security operations.  1+ years of hands-on work in a public cloud environment (AWS, Microsoft Azure, Oracle OCI), including core identity, network, and logging services.  1+ years supporting enterprise firewalls or remote access VPN preferred.  Working knowledge of TCP/IP, DNS, routing, NAT, VPN, and TLS, and the ability to trace a connection through them.  Experience with at least one scripting language (Python, PowerShell, Bash) for automation and reporting.  Exposure to enterprise security platforms in a production environment, such as SIEM, endpoint protection, vulnerability scanning, or firewall management.    Additional Skills,