[Hiring] Cybersecurity Engineer @Talent Acquisition Team

Role Description

The Herff Jones IT Team is seeking a Cybersecurity Engineer to join our Information Security team. This role owns the security tooling stack and detection engineering: the person who makes the platforms work, tunes them, and turns threat intelligence and incident lessons into detections. The Cybersecurity Engineer delivers security projects from the architecture roadmap and, with the Cybersecurity Manager, is a primary responder for major incidents.

Key Responsibilities

• Security Tooling Ownership
  • Administer, configure, and tune the organization's security platforms, including endpoint and cloud protection, SIEM and managed detection and response (MDR), vulnerability and attack surface management, application security, and email security.
  • Maintain tool health and coverage: onboarding, agent and sensor deployment, tooling maintenance, licensing use, integrations, and gap reports against the asset inventory.
  • Assist with the technical relationship with vendors, including the managed detection and response (MDR) provider, and keep escalation paths and playbooks current.
  • Automate repetitive work to cut analyst toil and configuration drift.
• Incident Response & Detection Engineering
  • Act as a lead incident responder during Priority 1–2 incidents.
  • Support the security analyst(s) and the MDR provider's SOC with tickets during volume surges; tune alerts and write response playbooks and automation for common alert types.
  • Measure detection quality: coverage by ATT&CK technique, false positive rate, and alert-to-incident ratio; run purple-team or atomic tests to validate rules.
  • Turn post-incident findings into new detections within an agreed time of closing the incident.
• Security Projects
  • Serve as technical lead for security roadmap initiatives across areas such as data protection, identity and access hardening, network and IT/OT segmentation, cloud security posture, and controls for emerging technologies, including AI tools.
  • Write designs, build and test changes, and hand off operational runbooks; follow the Change Management Plan.
  • Support PCI DSS technical controls with evidence the GRC Analyst can assess independently.
• Additional Responsibilities
  • Other duties as assigned.

Qualifications

• Required
  • Hands-on production experience with enterprise XDR/EDR, identity and access management, and endpoint management platforms, and with SIEM/XDR query languages (e.g., KQL, SPL, or similar).
  • Scripting or automation skills (PowerShell or Python); comfort with APIs.
  • Practical incident response experience and working knowledge of NIST SP 800-61 and MITRE ATT&CK.
  • Technical leadership and mentoring experience.
• Preferred
  • Industry security certifications such as CompTIA CySA+, GIAC (GCIH, GCIA), or vendor credentials including AWS Certified Security – Specialty, Cisco CCNP Security, CrowdStrike CCFR, Microsoft SC-200/SC-500, Palo Alto Networks PCNSE, Splunk Certified Cybersecurity Defense Analyst, or equivalent.
  • Experience with data loss prevention (DLP), vulnerability management programs, or application security tooling.
  • Familiarity with PCI DSS technical requirements and with OT or ICS environments.

Soft Skills

• Strong problem-solving and analytical mindset.
• Ability to communicate complex technical and security concepts to non-technical stakeholders.
• Composure and sound judgment under pressure during high-severity incidents.
• Collaborative and proactive attitude with a focus on continuous improvement.
• Strong organizational skills and attention to detail.

Education & Experience

• Bachelor's degree in Computer Science, Information Security, Information Technology, or a related field (or equivalent work experience).
• 5+ years in security engineering, security operations, or detection engineering.

Physical Requirements & Work Environment

• Remote position; work is performed primarily at a computer in a home-office setting with a reliable, secure internet connection.
• Prolonged periods of sitting and computer use.
• Must be available for after-hours and weekend response during Priority 1–2 security incidents and scheduled maintenance windows.
• Occasional travel to Herff Jones facilities may be required.