Security Engineer

Key Responsibilities

• Own day-to-day security operations: monitor alerts, triage and investigate incidents, lead response and containment, and document root cause and lessons learned.
• Administer and tune core security tooling, including endpoint detection and response, email security, identity and access management (MFA, SSO, conditional access), vulnerability scanning, and SIEM or log management.
• Secure the organization's Microsoft 365 / cloud environment, network infrastructure, and endpoints across dozens of distributed program sites.
• Run the vulnerability and patch management program: scan, prioritize by risk, coordinate remediation with IT and vendors, and track to closure.
• Design and enforce identity and access controls, including role-based access, least privilege, joiner/mover/leaver processes, and periodic access reviews.
• Support compliance with the regulations that apply to the organization's programs, including HIPAA, PCI DSS, state data-privacy laws, and government-grant security requirements; prepare evidence for audits and assessments.
• Assess the security of third-party vendors and SaaS platforms (case management, donor, HR, and financial systems) before and after onboarding.
• Build and deliver security awareness training and phishing simulations tailored to case workers, pantry and housing staff, volunteers, and leadership.
• Maintain and test business continuity, disaster recovery, and backup procedures so critical services stay available to the people served.
• Write and maintain security policies, standards, and run playbooks; help translate policy into practical guidance staff can follow.
• Provide security input on new projects, system implementations, and integrations from the start rather than after the fact.
• Track and report security metrics and risk posture to IT leadership and, as needed, to executive leadership and the board.

Requirements

• 3+ years of hands-on experience in information security, security engineering, or a security-focused systems/network administration role.
• Working knowledge of Microsoft 365 and Entra ID (Azure AD) security, Windows and endpoint security, and network fundamentals (firewalls, VPN, segmentation, Wi-Fi).
• Practical experience with at least several of the following: EDR, email security gateways, SIEM/log analysis, vulnerability scanners, MFA/SSO, backup and recovery tools.
• Experience leading or materially contributing to incident response.
• Familiarity with HIPAA Security Rule requirements and at least one security framework (NIST CSF, CIS Controls, or ISO 27001).
• Ability to explain security concepts clearly and patiently to non-technical colleagues and to build cooperative relationships across the organization.
• Strong documentation habits and the ability to work independently and prioritize in a small-team environment.
• Bachelor’s degree in computer science, information systems, or a related field, or equivalent practical experience.
• Security certification such as Security+, CySA+, GSEC, CISSP, or a Microsoft security certification (SC-200, SC-300, AZ-500).
• Experience in a nonprofit, healthcare, social services, or other resource-conscious, compliance-driven environment.
• Experience securing case-management, EHR, or donor/CRM platforms and working with grant or government-funded program requirements.
• Scripting ability (PowerShell, Python) for automation and reporting.
• Experience with PCI DSS scope reduction and payment-processing security.