IT Security Specialist

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

503-IT Full Time Professional Streetsboro, OH, US

5 days ago Requisition

Job Summary:

Step2 is looking for a security leader who thinks big picture and is also an expert at the keyboard. You will set security strategy, stay ahead of fast-changing threats (especially new attack methods and vulnerabilities that come with AI), and do the hands‑on work to protect our users, systems, data and sites. You will own our security program end to end: strategy, tools, vendors, training and incident response.

We want someone excited by the challenge of protecting Step2 as AI makes attacks faster, cheaper and harder to spot: someone who questions whether yesterday's tools still fit, learns fast, and designs new defenses where needed. This is not a role for someone looking to re‑implement a familiar legacy stack.

Job Duties:

• Strategy and threat intelligence: Track emerging threats, including AI‑enabled phishing, deepfake and social‑engineering attacks, prompt injection, data leakage through AI tools, and vulnerabilities in AI agents and integrations. Turn that into a security and business continuity strategy, with a tactical roadmap that stays current, and brief leadership on risk. The goal: no malware or device loss can take Step2 down.
• AI security: Set guardrails for how employees and systems use AI tools, agents and MCP connections. Review new AI tools and vendors for data exposure and access risk.
• Incident response and risk: Own the incident response plan, playbooks and courses of action. Run tabletop exercises, lead response when incidents happen, and maintain a risk register with mitigation plans.
• Business continuity: Build and test the continuity plan so malware, ransomware or device loss cannot stop the business. Includes fast device rebuilds, recovery of One Drive and Microsoft 365 data (versioning, retention and backup), and regular recovery drills.
• Hands‑on security operations: Set and verify security controls: MFA, conditional access and privileged accounts in Entra ;
  Microsoft 365 security settings; vulnerability management; firewall, VPN and segmentation rules, including plant networks; access reviews for employees and contractors. The Senior Manager, IT Infrastructure & Operations administers these platforms; this role defines and checks the controls.
• Endpoint security and disposable devices: Own the security strategy for employee laptops and mobile devices. Treat every device as disposable: work lives in One Drive and Microsoft 365, so any device can be wiped and replaced without losing data. Run remote scans, keep a live device and software inventory, find installed threats and unapproved software, remove malware, and isolate or wipe compromised devices remotely.
• Secure development (Dev Sec Ops ): Work with the software development team to design and enable CI/CD pipelines that include static (SAST) and dynamic (DAST) code analysis, plus dependency and secrets scanning. Cover industry‑standard vulnerability classes such as the OWASP Top 10 and CWE Top 25, and help developers fix findings.
• Vendors and tools: Select, implement and manage security vendors and monitoring tools (EDR, SIEM/MDR, email security, vulnerability scanning). Manage contracts, performance and budget.
• Security telemetry and reporting: Consolidate security telemetry and logs into Snowflake for analysis. Build dashboards and alerting (e.g. Grafana) that show risk, trends and program performance.
• Third‑party risk: Evaluate existing, proposed and new vendors against Step2's security compliance thresholds before and after onboarding. Apply the right…