Security Engineer - Hybrid

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Full Time Professional Headquarters, San Francisco, CA, US

30+ days ago Requisition

Salary Range: $ To $ Annually

For over a century, the Workers' Compensation Insurance Rating Bureau of California (WCIRB) has been California's trusted, objective provider of actuarially based information and research, advisory pure premium rates and educational services integral to a healthy workers’ compensation system. The WCIRB is a California unincorporated, private, nonprofit association comprised of all companies licensed to transact workers' compensation insurance in California. The operations of the WCIRB are funded primarily by membership fees and assessments;

no state money is used to fund its operations. The WCIRB is a stable company and a proven leader in the workers’ compensation insurance industry nationwide.

The WCIRB performs a number of functions to accurately measure the cost of providing workers' compensation benefits and ensure a healthy workers’ compensation system. To learn more about our company, please visit About Us | WCIRB California . The WCIRB employs approximately 175 people with the average tenure of over 10 years. We are committed to fostering a healthy, safe and diverse work environment leading to a dedicated, collaborative and innovative workforce This is a hybrid position where approximately 40% of the work time is spent at the home office in San Francisco, California.

The IT Security Engineer performs core security functions for the enterprise. The primary function of the role is the day-to-day operations of the in-place security solutions and the identification, investigation, and resolution of security events detected by those systems. Additional tasks may include involvement in the implementation of new security solutions, participation in the creation and or maintenance of policies, standards, baselines, guidelines, and procedures as well as conducting vulnerability audits and assessments.

The IT Security Engineer is expected to be fully aware of the enterprise’s security goals as established by its stated policies, procedures, and guidelines and to actively work towards upholding those goals. Microsoft Defender experience is required.

To be considered, candidates need a minimum of 3+ years of experience with all components of the Microsoft Defender Security Stack (XDR, Endpoint, Identity, Cloud Apps, Office 365, Sentinel).

• Participate in the planning and design of enterprise security architecture, under the direction of the Director of Security, where appropriate.
• Participate in the creation of enterprise security documents (policies, standards, baselines, guidelines, and procedures) under the direction of the Director of Security, where appropriate.
• Maintain up-to-date detailed knowledge of the IT security industry including awareness of new or revised security solutions, improved security processes, and the development of new attacks and threat vectors.
• Recommend additional security solutions or enhancements to existing security solutions to improve overall enterprise security.
• Perform the deployment, integration, and initial configuration of all new security solutions and of any enhancements to existing security solutions in accordance with standard operating procedures generically and the enterprise’s security documents specifically.
• Maintain up-to-date baselines for the secure configuration and operations of all in-place devices, whether they be under direct control (i.e. security tools) or not (e.g. workstations, servers, network devices).
• Maintain operational configurations of all in-place security solutions as per the established baselines.
• Monitor all in-place security solutions for efficient and appropriate operations.
• Deliver training and phishing simulations for the enterprise’s security awareness training program.
• Review logs and reports of all in-place devices, whether they be under direct control (i.e. security tools) or not (e.g.…