Security Engineer

• Own SIEM alerting end-to-end, including log ingestion, detection rules, tuning, and reducing false positives
• Act as first responder for security incidents; investigate, contain, and drive incidents to closure using runbooks
• Feed recurring incident issues into preventive controls
• Administer the IdP, including SSO via SAML/OIDC, MFA, and conditional access
• Run access recertification across the IdP, SaaS, AWS, and internal tools
• Identify stale and over-permissive access; enforce least privilege and PAM
• Detect segregation-of-duties gaps and improve joiner-mover-leaver and third-party access processes
• Improve SaaS security posture across Google/Microsoft, Slack, GitHub, and other platforms
• Apply DLP controls to limit data leakage
• Maintain and tune endpoint security, including MDM, XDR/AV, and device-compliance checks for VPN/ZTNA
• Define endpoint posture requirements and automate remediation
• Defend against phishing and spoofing using secure email gateway rules and DMARC/SPF/DKIM
• Run phishing simulations and security awareness programs and act on results
• Build internal tooling and automate repetitive security operations
• Own the roadmap for security areas, identify gaps, lead initiatives independently, and improve security architecture