Cybersecurity Engineer

This position will report to HB Mechanical Group, LLC, a subsidiary of HB Global. We empower our employee owners to make this a great place to work and create value.

SUMMARY:

The Cybersecurity Engineer is HB Global's dedicated, hands-on owner of cybersecurity operations and engineering across the enterprise. Reporting to the Director of IT, who owns the enterprise security strategy, and partnering with third-party solution architects where specialized design is required, this role translates strategy into working, well-managed security controls.

It is a true generalist position: on any given week the engineer performs day-to-day threat hunting, monitoring, and incident response, then implements, configures, and manages the tools that protect the organization.

This position operates in a multi-division enterprise environment in which divisions maintain autonomy in business decisions; the Cybersecurity Engineer maintains consistent enterprise security standards while adapting to each division's needs and supporting the integration of newly added business units.

• Trust:
  Clear Communication. Be committed. Accountable. Open. Honest.
• Team:
  No "I". Do what's best. Assume the best. Be a leader. Celebrate wins.
• Grit:
  Goal-focused. Be positive. Persevere. Show passion. Take ownership.
• Growth:
  Lifelong learner. Forward-thinker. Self-aware. Curious. Open-minded.

This is a full-time position with benefits. The role is a hybrid Remote-On Site position; we prefer candidates within driving distance of the HB Mechanical Group office in Camp Hill, PA or the Tamarac, FL office, and will consider strong candidates residing anywhere in the U.S. Eastern time zone. Hours may vary according to business needs. Occasional travel between HB Global offices and divisional worksites may be required.

On-call availability for security incidents and urgent requests is required.

• Perform day-to-day threat hunting, monitoring, and alert triage across the Crowd Strike Falcon platform (EDR, NG-SIEM, and Identity Threat Protection). Investigate, contain, and remediate security incidents end to end; perform root-cause analysis and document findings and lessons learned. Tune detections, correlation rules, and alerting to reduce noise and improve fidelity. Monitor and respond to email-borne threats and user-reported phishing through Mimecast, managing quarantine and policy tuning.

• Implement, configure, and maintain security controls across Microsoft Azure and on-premises systems, coordinating with third-party architects on solution design where required. Administer identity and access security across Microsoft Entra  / Active Directory, Okta, Microsoft 365, and Google Workspace, enforcing least privilege, MFA, and conditional access.
• Manage endpoint protection and DNS-layer security (Cisco Umbrella), and support network security policy on Cisco Meraki in partnership with the Senior Network Administrator.
• Own vulnerability management, including scanning, prioritization, and coordinating remediation within the IT team.
• Partner with the Senior Systems Administrator - who administers our data protection and recovery tools (Druva, Veeam) - to validate and test backup integrity and to participate in disaster-recovery testing.
• Manage the secrets and password platform (1
  
  Password) and champion strong credential hygiene across the organization.

• Maintain security configuration standards and hardening baselines aligned to the strategy set by leadership.
• Plan, track, and report on security initiatives using Zoho Projects.
• Manage day-to-day relationships with security vendors and managed-service providers, holding third parties accountable to their commitments.
• Own the Mimecast security-awareness program, including scheduling and managing quarterly awareness trainings and quarterly phishing simulations, and reporting on progress and completion rates.

• Produce clear, regular reporting on the organization's overall…