Information Security Associate Engineer

Under general direction, Information Security Associate Engineers apply principles of computer science, security engineering, and risk analysis to protect the organization's applications, infrastructure, data, and cloud environments. They support the design, implementation, monitoring, and continuous improvement of security controls across on-premises and cloud platforms, helping to identify vulnerabilities, respond to incidents, and reduce risk to an acceptable level.

Core responsibilities include monitoring security tooling, assisting with vulnerability management, supporting identity and access management (IAM), and helping secure cloud workloads across providers such as AWS or Azure. This includes configuring cloud security posture management (CSPM) tools, reviewing cloud architecture for misconfigurations, and supporting encryption, logging, and network segmentation practices.

Information Security Associate Engineers may specialize in one area such as Security Operations, Cloud Security, Application Security, Identity and Access Management.

• Monitor security alerts, logs, and dashboards (SIEM/SOAR) to identify, triage, and elevate potential security incidents.
• Assist in performing vulnerability assessments and coordinate remediation of findings across applications, infrastructure, and cloud resources.
• Support the configuration, hardening, and maintenance of cloud environments (AWS, Azure), including identity, network, storage, and workload security controls.
• Use cloud security posture management (CSPM) and cloud-native tools to detect misconfigurations, excessive permissions, and non-compliant resources.
• Support identity and access management (IAM) activities, including access reviews, role-based access control (RBAC), and least-privilege enforcement.
• Assist with incident response activities, including evidence gathering, containment support, and documentation of findings and timelines.
• Develop and maintain technical security documentation, including runbooks, diagrams, playbooks, and standard operating procedures.
• Support security control implementation aligned to frameworks such as NIST CSF, ISO 27001, or CIS Benchmarks.
• Assist with risk assessments, helping identify, document, and prioritize security risks across systems, applications, and cloud environments.
• Participate in code and architecture reviews to identify security weaknesses and recommend secure design practices (e.g., OWASP Top 10).
• Assist with encryption key management, secrets management, and secure configuration of data at rest and in transit.
• Support patch management and endpoint protection efforts across servers, workstations, and cloud workloads.
• Contribute to security awareness efforts and provide guidance to internal teams on secure development and operational practices.
• Stay current on emerging threats, attacker techniques, cloud security best practices, and evolving compliance requirements.
• Share technical knowledge and mentor team members to support collaborative learning and continuous improvement.
• Analyze security metrics and reports to validate that controls meet defined risk, reliability, and service-level goals.
• Other duties as assigned.

• 0-3 years of experience in information security, IT security, or a related technical field.
• Bachelor's degree in computer science, cybersecurity, information systems, or a related field, or equivalent experience.
  • Equivalent combinations of education and experience may be considered.
• Security-related certification preferred, such as CompTIA Security+, Systems Security Certified Practitioner (SSCP), or an equivalent entry-level credential.
• Cloud security…