Hybrid Network Security Engineer — Onsite

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

INFORMATION TECHNOLOGY Full Time Rochester, NY, US

30+ days ago Requisition

Job Title: Network Security Engineer
Department: Information Technology
Location: Rochester, NY
Classification: Exempt
Reports To: Director of Information Technology

Please note:
Candidates must be authorized to work in the United States and able to work onsite in the Rochester, NY office. Sponsorship is not available for this position.

Company Overview:

Woods Oviatt Gilman, LLP is a leading and reputable full-service law firm dedicated to providing exceptional legal services to our clients. With a team of highly skilled and experienced attorneys, we strive to deliver comprehensive and effective solutions to meet the diverse needs of our clients. Our headquarters is in Rochester, NY with additional offices in Albany and Buffalo, NY.

We foster a collaborative and inclusive work environment where every team member is valued and respected. We encourage open communication, teamwork, and professional growth. Our firm promotes a healthy work-life balance and supports the well-being of our employees.

Position Summary:

The Network Security Engineer is a hands-on technical role responsible for implementing and maintaining the firm’s security controls across a hybrid Microsoft environment, including Forti Gate firewalls, endpoint protection, Microsoft 365 and Intune, data protection, and a co-managed monitoring service. Working under the direction of the Director of Information Technology, who sets security policy and priorities, the Engineer provides the technical assessment, recommendations, and documentation behind those decisions, and exercises the judgment and discretion required to protect privileged client information.

Duties and Responsibilities:

• Administer and tune Forti Gate firewalls, and maintain segmentation, remote access, and wireless security
• Administer Crowd Strike and Microsoft Defender, and manage device compliance and encryption in Intune
• Maintain identity and access controls in Entra  Active Directory, including MFA, conditional access, and privileged accounts
• Maintain cloud email security, including filtering rules, phishing defenses, and SPF, DKIM, and DMARC records
• Lead the firm’s data loss prevention and data classification program in Microsoft Purview, including sensitivity labels and policy tuning
• Support retention, eDiscovery, and information barrier requirements in coordination with firm counsel
• Assess AI platforms and cloud services before adoption, and implement the firm’s AI acceptable use controls
• Serve as daily technical contact for the firm’s managed monitoring service, triaging and validating alerts
• Investigate security events, perform containment and recovery, and contribute to incident response planning and tabletop exercises
• Perform vulnerability and patch management across servers, endpoints, and network devices
• Conduct vendor and application security reviews, and implement controls supporting NIST CSF, CIS Controls, or ISO 27001
• Prepare technical responses for client security questionnaires, audits, and SHIELD Act obligations
• Administer security awareness and phishing simulation program

Technical Skills:

Required

• Forti Gate firewall administration, including policy, VPN, and intrusion prevention
• Endpoint detection and response, ideally Crowd Strike Falcon, and Microsoft Defender
• Microsoft 365 security administration, email protection, and SPF, DKIM, and DMARC
• Microsoft Entra , Active Directory, and Intune in a hybrid configuration
• Microsoft Purview sensitivity labels, data classification, and data loss prevention
• Networking…