Security Engineer

Security Engineer

Department: Information Technology

Employment Type: Permanent - Full Time

Location: Downtown Boston - Tremont Street

Compensation: $91,000 - $94,000 / year

The Information Security Engineer is responsible for safeguarding ABCD’s systems, networks, and sensitive client and employee information across a 40+ site, multi-program environment. This role serves as ABCD’s primary internal cybersecurity subject matter expert. The Engineer leads security operations, incident response, risk management, and security program development while strengthening the organization’s overall cybersecurity maturity. The position combines hands‑on technical execution with practical governance and risk oversight to support mission‑critical community services.

• Monitor, investigate, and respond to security alerts across cloud and on-premises systems.
• Maintain and improve detection rules, alerting, and response playbooks.
• Oversee log visibility and security monitoring across identity, endpoint, email, and network systems.

• Lead end-to-end incident response (phishing, malware, account compromise, data exposure, suspicious activity).
• Coordinate containment, eradication, recovery, documentation, and post-incident reviews.
• Conduct periodic incident response exercises and ensure lessons learned result in strengthened controls.
• Escalate significant risk conditions to ITS leadership with clear remediation recommendations.

• Manage vulnerability scanning, remediation tracking, and risk prioritization.
• Partner with infrastructure and support teams to ensure timely patching and mitigation.
• Conduct risk assessments for new systems, integrations, and cloud services.
• Maintain secure configuration baselines aligned with recognized frameworks (NIST, CIS Controls).

• Strengthen identity and access management controls (MFA, conditional access, privileged access, lifecycle management).
• Maintain least‑privilege standards and periodic access reviews.
• Advance data protection practices including encryption, secure sharing, and retention controls.
• Support data classification and protection of highly sensitive program information.

• Develop and maintain security policies, standards, and procedures.
• Support compliance with applicable federal, state, and grant‑based cybersecurity and privacy requirements.
• Coordinate security documentation required for audits and cyber insurance renewals.
• Track and report key security metrics and risk trends to ITS leadership.
• Contribute to the development of a multi‑year cybersecurity roadmap aligned with organizational risk.

• Deliver or coordinate security awareness initiatives, including phishing simulations.
• Improve secure email handling and reporting workflows across the organization.
• Partner with program leadership to reinforce secure practices in field and client‑facing environments.

• Conduct security reviews of vendors and systems (questionnaires, SOC reports, risk analysis).
• Track vendor remediation commitments and contract‑related security obligations.

• Support business impact analysis and recovery planning.
• Coordinate backup validation and participate in recovery testing to ensure operational resilience.

Experience with some of the following is helpful (not all required):

• Google Workspace security and administration
• Endpoint security / EDR and device management
• Network security appliances, firewalls, VPN, DNS filtering
• Vulnerability management platforms
• SIEM or centralized log management tools

• 3–7 years of progressive experience in security engineering, security operations, or IT security administration.
• Strong working knowledge of identity and access management, endpoint security, email security, network fundamentals, vulnerability management, and incident response.
• Demonstrated ability to translate security risk into practical, prioritized remediation in resource‑constrained environments.
• Excellent documentation skills (incident reports, risk findings, SOPs)
• Strong communication skills and ability to work effectively with non‑technical staff and program leadership.

• Experience in a multi‑site or nonprofit…