Sr. Infrastructure Security Engineer

This role will be responsible for strengthening the security posture of our on-premises Windows/Active Directory environment and Microsoft 365 tenant, while also supporting core systems administration as needed. This role will need to partner closely with the IT Security team, networking teams, and the rest of IT to prioritize solutions and implement them.

• Security & Hardening (Primary Focus)
• Implement and maintain secure configurations across Windows Server, Active Directory, and Microsoft 365 using CIS benchmarks and industry best practices.
• Perform regular security posture assessments and remediate gaps.

• Tiered administration model (Tier 0/1/2)
• Removal of insecure protocols
• LAPS implementation and privileged credential protection

Identity & Active Directory Securit Conduct ongoing AD hygiene and security reviews, including:

• Privileged group membership audits
• AD ACL and delegation reviews
• Service account inventory
• Cleanup of stale objects
• Help implement Privileged Access Management (PAM) and least privilege models.
• Microsoft 365 / Entra
• Design and maintain Conditional Access policies and MFA enforcement.

• Secure Score optimization
• Identity protection and sign-in risk policies.

• App registrations, enterprise apps, and OAuth permissions.
• Guest access and external collaboration settings.
• Support configuration and tuning of Microsoft Purview DLP, sensitivity labels, and information protection controls in partnership with IT Security and compliance stakeholders.
• Patching, Vulnerability, & Lifecycle Management

• Windows Server updates (including emergency CVE patching)
• Hypervisor and firmware updates
• Third-party application patching
• Track and remediate vulnerability scan findings.
• Coordinate end-of-life remediation (OS, hardware, platforms).
• Backup, Recovery, & Resilience
• Ensure backups are not only successful, but recoverable.
• Lead restore/recovery testing and DR exercises.
• Validate immutable and air-gapped backup strategies.
• Maintain and improve DR runbooks aligned to RPO/RTO goals.
• Monitoring, Detection & Response
• Review and respond to infrastructure and identity-related security alerts, escalating to IT Security as appropriate.
• Tune alerts to reduce noise and increase actionable signals.
• Partner with IT Security team to investigate infrastructure and identity-related security. events, support containment/remediation actions, and perform root cause analysis.
• Endpoint & Network Security
• Partner with Network Engineering and IT Security to review firewall rules, identify overly permissive access, and support remediation based on least privilege and segmentation principles.

• Removal of local admin rights
• Hardening endpoint configurations
• Documentation & Process Improvement
• Define remediation plans with risk-based prioritization.
• Create and maintain security-focused runbooks and procedures.
• Conduct quarterly access reviews and participate in tabletop incident response exercises.
• Help establish repeatable security operational processes, developing automation where possible.
• Establishes and maintains operational procedures and practices.
• Collaboration with System Admin Team
• Act as the security subject matter expert for the infrastructure team.

• Secure system builds
• Patch cycles
• Incident remediation
• Step in to assist with core sysadmin tasks during high-demand periods.
• Change Management
• Support change control processes, perform risk assessment of changes before deploying to production, define deployment plans, and coordinate deployments with cross-functional teams.
• Complies with safety and cGMP requirements.

Supports a culture of safety; follows all workplace health and safety procedures. Responsible for safety performance in respective area. Ensures the implementation of, adherence to, and enforcement of workplace health and safety requirements. Ensures activities are completed to promote and enforce safe behaviors by supervisors and employees. Ensures injury prevention efforts are effectively implemented. Fulfills responsibilities as outlined in the company safety management plan.

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The…