Lead Engineer: Information Security

About the role

Mayer Brown is seeking a Lead Engineer: Information Security to join our Information Technology department in our Chicago, Los Angeles, or Salt Lake City office. This role is responsible for implementing, integrating, and maintaining security technologies and controls across the Firm's cloud, data, identity, and enterprise platforms.

Responsibilities

• Implement, integrate, and maintain security technologies and controls that support the Firm's security architecture and roadmap
• Provide hands-on technical leadership for strategic IT and security projects and initiatives
• Operationalize security architectures, standards, and reference patterns defined by security architects
• Ensure consistent implementation and configuration of security controls across systems and platforms
• Collaborate with other engineers and IT teams to apply best practices for security, server hardening, change management, account management, and user experience
• Implement and maintain security controls across cloud and enterprise platforms, including Azure, Microsoft 365, Teams/O365, and iManage Cloud
• Configure and tune security tooling to align with defined design patterns and business requirements
• Maintain monitoring, alerting, and detection capabilities in accordance with business needs
• Contribute to Business Continuity and Disaster Recovery planning and execution from a security engineering perspective
• Implement and maintain identity, authentication, and authorization controls for internal and business-to-business integrations
• Control access to the Firm's information systems and related security configurations
• Implement, tune, and operate Data Loss Prevention (DLP) systems and processes
• Analyze data collected from DLP systems to ensure compliance with Firm policies and support policy tuning
• Aid in defining DLP policies and workflows to protect firm and client data, and develop metrics for measuring effectiveness of the DLP solution
• Implement controls to prevent or minimize unauthorized or undesirable use of IT facilities and firm data
• Implement and operate security controls for AI and Generative AI solutions in alignment with firm architecture and policies
• Support security reviews and control implementation during evaluation and onboarding of AI/GenAI tools
• Aid in securing AI-driven systems and leveraging AI tools to enhance security operations
• Escalate operational risks and gaps associated with AI usage to security leadership and architecture teams
• Assist in the preparation, approval, implementation, and adherence of the Information Security Policies within the Firm
• Support the development and authorization of new IT policies, ensuring the necessary security audits and tests are carried out prior to being introduced into production
• Support independent reviews of the security program and ensure identified gaps are addressed
• Ensure security risks are managed and communicated clearly and effectively
• Support client security assessments, audits, and regulatory inquiries by providing technical evidence and implementation details
• Partner with Legal Risk, Compliance, and IT teams to ensure security controls are implemented in alignment with client obligations and regulatory expectations
• Coordinate with vendors on the operational delivery and support of security tooling
• Collaborate with security architects and peer engineers to deliver cohesive, secure solutions
• Contribute to the development of reusable engineering patterns, playbooks, and technical standards
• Provide technical guidance and knowledge sharing to team members and IT partners
• Participate in design reviews to ensure implementations align with firm architecture principles
• Ensure information is openly communicated and shared with other members of the Global Security Team
• Educate Mayer Brown's employees on the benefits of security to the organization, themselves, and their working environment
• Keep the Security Awareness site on GlobalNet updated with current material
• Develop and maintain documentation related to Global Security Team operations, functions, and engineering procedures
• Ensure adherence to change control processes and communicate impacts to partners and staff
• Monitor methods of physical data security, such as the storage of backup media, and propose/implement any changes where necessary
• Manage projects and tasks related to the Firm as directed by the Assistant Director: Global Information Security
• Keep abreast of emerging security threats, technologies, and industry practices
• Perform other duties as assigned or required to meet Firm goals and objectives

Qualifications, Experience and Personal Attributes

• Bachelor's degree in a related field. An equivalent combination of education and/or experience may be considered in lieu of the degree when the experience has been directly related to the functions of the job
• CISSP certification preferred
• Cloud security certifications/training preferred
• Knowledge of AI/GenAI security concepts preferred
• Professional Experience: 5+ years of experience in an Information Security department, with hands-on engineering and implementation responsibilities
• Demonstrated experience implementing security controls in cloud-first environments (e.g., Azure, Microsoft 365, SaaS platforms)
• Experience supporting incident response, DLP operations, and vulnerability management activities
• Technical Skills: Excellent working knowledge of security engineering concepts aligned with CISSP domains required; Excellent working knowledge of networking and security standards required; Good knowledge of ISO 27001/27002 and NIST frameworks preferred; Strong technical knowledge of cloud environments such as Azure, Microsoft 365, and O365; Experience with identity and access management concepts (e.g., least privilege, privileged access, conditional access, SAML/OIDC); Familiarity with DLP incident handling, remediation, and reporting; experience with data protection tooling (e.g., Microsoft Purview); familiarity with enterprise security tooling such as Microsoft Defender for Endpoint, Thales, CrowdStrike Falcon, CrowdStrike NG-SIEM, CyberArk, Rapid7, and Palo Alto is a plus; Good documentation skills and authentication methods experience required; Good knowledge of Disaster Recovery preferred; Experience in securing AI-driven systems and leveraging AI tools; Proficiency in Microsoft Office products
• Performance Traits: Strong written and verbal communication skills, able to communicate and negotiate effectively and in a professional manner with all levels of the Firm and outside vendors; Ability to work in a diverse global team environment and effectively support the demanding needs of the Firm; Ability to work under pressure, meet deadlines with shifting priorities; Self-starter with a high level of initiative; Strong customer service skills, able to anticipate needs and exercise independent judgment; Strong attention to detail, organizational skills, and the ability to handle multiple projects; Maintains confidentiality and exercises discretion; Exercises solid strategic thinking and problem-solving skills; Willingness to challenge the status quo

Education/Training/Certifications

Education/Training/Certifications: Bachelor's degree in a related field. An equivalent combination of education and/or experience may be considered in lieu of the degree when the experience has been directly related to the functions of the job. CISSP certification preferred. Cloud security certifications/training preferred. Knowledge of AI/GenAI security concepts preferred.