- Company Name
- Brightwell
- Job Title
- Cybersecurity Engineer
- Job Description
-
Job title: Cybersecurity Engineer
Role Summary: Senior engineer responsible for managing SOC2 Type II and PCI DSS compliance programs while conducting threat modeling, penetration testing, and incident response on Azure-based applications and infrastructure; serves as the primary technical liaison with auditors, CCO, and GC.
Expactations: • 7+ years of hands‑on security experience in financial or highly regulated environments
• Proven leadership of SOC2 Type II and PCI DSS program ownership, including control design, policy development, and audit coordination
• Strong technical skills in penetration testing, vulnerability assessment, code review (auth/authz, data protection), and Azure security (NSGs, Azure AD/Entra ID, Key Vault, Security Center)
• Experience managing SIEM, endpoint protection, vulnerability scanners, and integrating security into CI/CD pipelines
• Independent subject‑matter expert with excellent written and verbal communication; able to explain complex security concepts to both technical and non‑technical stakeholders
• Analytical incident‑response capabilities with root‑cause analysis and preventive controls
• Preferred, but not required, credentials: CISSP, OSCP, CEH, GIAC, or Azure Security certifications.
Key Responsibilities: • Own SOC2 Type II program execution: control design, audit prep, evidence collection, and liaison with external auditors.
• Develop and maintain security policies, procedures, and control narratives aligned with SOC2 Trust Services Criteria and PCI DSS.
• Lead risk assessments and internal control testing; produce technical documentation (diagrams, architecture, data flows).
• Manage PCI vulnerability scans and penetration testing; coordinate remediation with development and infrastructure teams.
• Conduct threat modeling, security assessments, and code reviews for Azure‑based apps and APIs; validate and design network, identity, and data protection controls.
• Operate and optimize security tooling (endpoint protection, SIEM, vulnerability scanners, automated testing).
• Investigate and respond to security incidents, performing root‑cause analysis and recommending preventive measures.
• Partner with DevOps to embed security into CI/CD pipelines and evaluate new security automation technologies.
• Provide security training and guidance to foster a secure culture.
Required Skills: • SOC2 Type II, PCI DSS compliance program management.
• Azure security architecture (NSGs, Azure AD/Entra ID, Key Vault, Security Center).
• Penetration testing, vulnerability assessment, and secure code review.
• SIEM, endpoint protection, vulnerability scanning, and automated testing platforms.
• Incident‑response and root‑cause analysis.
• Strong written and oral communication; stakeholder engagement.
• Independent decision‑making as a subject‑matter expert.
Required Education & Certifications: • Bachelor’s degree in Information Security, Computer Science, or related field (or equivalent experience).
• Preferred certifications: CISSP, OSCP, CEH, GIAC, Azure Security, etc.