Cyber Security Engineer II

Senior Cyber Security Engineer

Johns Manville seeks a Senior Cyber Security Engineer to lead the design, implementation, administration, and support of complex enterprise security initiatives across a global environment. This remote/hybrid position requires U.S. residency and occasional travel to the Denver headquarters and other JM facilities.

Pay Range: $–$ Annual (base salary); eligible for incentive bonus.

• Security Architecture and Engineering (10%) – Lead design, implementation, and support of enterprise cybersecurity solutions and security architecture initiatives across infrastructure, cloud platforms, endpoints, identity systems, and manufacturing environments. Conduct security research, evaluate emerging technologies, and recommend solutions. Develop and maintain secure configurations, standards, and technical documentation.
• Security Project Management and Implementation (10%) – Lead and support cybersecurity projects involving multiple business units, vendors, and stakeholders. Manage implementation of security technologies, coordinate timelines, deliverables, testing, validation, and operational transition. Support integration of cloud services, endpoint technologies, vulnerability management platforms, SIEM/SOAR solutions, and identity security initiatives.
• Operational Security Management (30%) – Administer, maintain, and optimize security platforms including cloud security technologies, EDR/XDR, email security, identity and access management, data protection, SIEM/SOAR, and vulnerability management. Develop advanced threat detections, correlation rules, dashboards, and automation workflows. Utilize KQL for threat hunting and investigation across Microsoft Sentinel, Microsoft Defender, Azure, Microsoft 365, AWS, and related platforms.
• Vulnerability Management and Risk Reduction (15%) – Lead vulnerability management initiatives across infrastructure, cloud services, endpoints, applications, and operational technology. Coordinate remediation with infrastructure and application teams, prioritize based on risk, and report to technical leadership. Support penetration testing coordination and remediation tracking.
• Technical Collaboration and Mentoring (5%) – Collaborate with engineering, cloud, networking, Dev Ops, and business teams to implement secure solutions and resolve issues. Mentor cybersecurity engineers and analysts, provide training, and develop procedural documentation.
• Incident Response, Detection Engineering, and Forensics (30%) – Lead incident handling, investigation, containment, eradication, and recovery. Develop and maintain threat detections, response processes across SIEM, EDR/XDR, and cloud platforms. Analyze escalated alerts, create custom detection logic, and coordinate remediation plans. Prepare executive‑level incident reporting and root‑cause analysis. Utilize Power Shell scripting and automation to support investigations and operational efficiency.

• Bachelor’s degree with a minimum of 7 years of IT experience, OR 7–10 years of overall IT experience with at least 7 years focused in cybersecurity/network security.
• Two or more certifications: CISSP, GIAC, Microsoft Security, Azure Security, or equivalent.
• Master’s degree in Cybersecurity, Information Security, Computer Science, or related field acceptable in lieu of some experience.
• Expert‑level experience supporting enterprise cybersecurity technologies and operations.
• Advanced experience with SIEM and SOAR technologies, including security automation, orchestration, and incident response workflow development.
• Strong KQL (Kusto Query Language) skills for threat hunting, analytics, detections, dashboards, and investigations.
• Strong Power Shell scripting and automation experience.
• Deep understanding of incident response, threat detection engineering, and forensic analysis best practices.
• In‑depth experience with vulnerability management programs, scanning platforms, remediation coordination, and risk prioritization.
• Experience implementing and managing security technologies in cloud, hybrid, and on‑premises environments.
• Experience with Microsoft Sentinel, Microsoft Defender, Crowd Strike, Tenable,…