Information Security Engineer

Overview

The Information Security Engineer is a hands-on generalist role within the IT Services Delivery Team, responsible for both security engineering operations and governance, risk, and compliance (GRC) activities across Enercon Technologies’ production platforms; both in proactively hardening and securing the environment and responding to security events and compliance requirements.

This position is responsible for the effective implementation, operation, and maintenance of information security controls, tools, and infrastructure. Directly performs security hardening, patch deployment, vulnerability remediation, and security configuration management across the production environment. Leads effort for security operations and either partners with or escalates security issues to external contractors based on an escalation and support framework.

Supports and applies security frameworks such as the NIST Cybersecurity Framework, CIS Critical Security Controls, and ISO/IEC 27001 in the management of security operations, risk assessments, and compliance activities. Where such resolution is beyond the capabilities of this team, provides well documented escalation requests to external contractors for ultimate disposition and once resolved updates knowledge bases sufficient to reduce repetitive security incidents in the future.

Manages and directs the design, implementation, and maintenance of Enercon’s information security infrastructure and controls.

In the role of Information Security Engineer:

• Directly performs hands-on security operations, including system hardening, patch deployment, security-driven upgrades, and implementing security configurations across servers, endpoints, and infrastructure
• Defines and implements security configurations, access controls, and secure system builds, and provides guidance to IT teams on secure implementation practices
• Reviews vulnerability scan results, prioritizes findings, and directly remediates or coordinates remediation of identified vulnerabilities across systems and infrastructure
• Administers and maintains security tools and platforms used for monitoring, detection, and response across the environment
• Monitors security alerts, logs, and reports to identify potential security events and trends
• Evaluates system and application changes for security impact and compliance with security standards
• Participates in incident response activities, including investigation, documentation, coordination, and post-incident analysis
• Develops, maintains, and enforces information security policies, standards, procedures, and guidelines
• Implements and operates the organization’s information security program in alignment with frameworks such as the NIST Cybersecurity Framework (CSF), CIS Critical Security Controls, ISO/IEC 27001, and SOC 2 Trust Services Criteria
• Performs security risk assessments, documents risk findings, and defines remediation and risk treatment plans
• Monitors and evaluates the effectiveness of administrative, technical, and operational security controls
• Tracks security risks, remediation activities, and corrective action plans to completion
• Executes vendor and third-party risk management activities, including security assessments, documentation review, and risk classification
• Supports compliance initiatives related to customer, contractual, and regulatory security requirements
• Coordinates and participates in internal and external audits, security assessments, and customer security reviews
• Maintains security documentation including policies, standards, procedures, risk registers, system security documentation, and security plans
• Develops and maintains security metrics, dashboards, and reporting for management review
• Contributes to security awareness initiatives and promotes secure practices across the organization
• Stays current on emerging threats, vulnerabilities, and industry best practices and incorporates improvements into the security program
• Performs other Information Systems and security-related duties as required

The skills you need to succeed:

• Strong understanding of information security principles, risk management, and governance
• Experience implementing and operating…