Security Engineer - Junior

Security Engineer — GRC, Cloud, Workspace & IdAM

Reports to: Director, Systems Operations & Cybersecurity
This role runs programs that most organizations staff separately: governance and compliance, cloud, SaaS, Identity and Access Management security posture, and the assessment cycle that tests them all.
There are no direct reports, and nearly everything that needs to change is owned by someone else — a cloud engineer, an application owner, a business-unit administrator. The work is therefore split between doing (assessing, documenting, evidencing, configuring) and driving (getting findings closed by people who do not report here).
The Director owns policy approval, budget, vendor contracts, and executive reporting. Governance, Risk & Compliance
Maintain the security policy and standards library — drafting, revision cycles, approvals, publication, and attestation tracking.
Own the risk register day to day: intake, scoring, treatment plans, owner assignment, and review cadence.
Run exception and risk-acceptance governance: documented, time-bound, owned, and reviewed on expiry rather than renewed by silence.
Own third-party and vendor risk reviews, including pre-contract security assessment and periodic reassessment of critical suppliers.
Complete customer and partner security questionnaires; Administer and maintain identity security platforms and directories (e.g., Design and enforce secure remote access.
Google Workspace & SaaS Security
Own the security configuration of Google Workspace: admin console hardening, context-aware access, 2SV enforcement, Drive external sharing controls, Gmail threat protection and routing rules, DLP policies.
Govern third-party OAuth application access — review, approve, restrict, and periodically re-review what has been granted access to corporate data.
investigate and escalate anomalous access, sharing, and configuration change.
Extend the same discipline to the broader SaaS estate: inventory sanctioned applications, review security configuration at onboarding, and identify shadow IT.
Cloud Security
Operate the cloud security posture platform (Wiz) across GCP/AWS/Azure: coverage, policy tuning, and triage of misconfigurations, exposed workloads, and toxic combinations.
Review cloud IdAM configuration — over-permissive roles, standing access, unused credentials, key hygiene.
Contribute cloud security requirements to new architecture and provide secure-by-default baselines that teams can adopt without a consultation.
Partner with the network and endpoint security functions on shared telemetry, logging coverage, and detection gaps.
Maintain a single consolidated view of open findings across all sources (pen test, audit, cloud posture, vulnerability scanning, assessments) so remediation is prioritized once, not five times.
Policy, findings, risk narratives, and evidence summaries are the primary output of this role — writing quality is a core requirement, not a soft skill.
Give the Director an accurate picture without prompting — what is closing, what is stuck, what needs escalation or a risk decision.
Present assessment and compliance status to stakeholders across the business units at a defined cadence, showing trend and decision rather than raw counts.
Keeps the evidence current continuously, so audits and insurance renewals are a retrieval exercise rather than a fire drill.
5+ years in information security, with demonstrated ownership of a GRC program or a substantial portion of one.
~ Hands-on experience with cloud security posture management (Wiz or comparable tool) and practical understanding of cloud IdAM and misconfiguration risk in at least one major provider.
~ Administration or security-configuration experience with Google Workspace (or comparable enterprise SaaS suite), including sharing controls, DLP, and OAuth app governance.
~ Strong technical writing. Candidates should expect to provide a writing sample.
~ Bachelors degree or equivalent practical experience.

CISSP, CISA, CCSK, CISM, or cloud provider security certification.
Experience administering and maintaining security platforms such as Okta, Password Safe, Crowdstrike, Wiz, Palo Alto XSIAM, and ExtraHop.
Scripting for evidence collection and reporting automation (Python, PowerShell, or equivalent).
Experience with cyber insurance underwriting questionnaires or M&A technology due diligence.
Policy library and risk register inventoried and current-state assessed; Wiz, Workspace, and IdAM configurations baselined against benchmark; cloud, Workspace, and identity findings closing against SLA with measurable backlog reduction; third-party risk review process operating at onboarding.
measurable reduction in external Drive exposure and over-permissive cloud/IdAM roles; risk register reviewed in a standing governance forum with business participation.
Occasional travel to sites/facilities.
Hybrid/Atlanta office onsite expectations.
We do not discriminate on the basis of race, color, national origin, gender, gender identity, sexual orientation, age, disability, religion, veteran status, or any other protected characteristic.