Cerity Partners is a financial services firm seeking a Cybersecurity Engineer to join their growing cybersecurity team. This role involves engineering, administration, and optimization of security tools and infrastructure, with a focus on protecting their Microsoft Azure / M365 cloud environment and ensuring compliance with security frameworks.
Responsibilities:
- Deploy, configure, tune, and maintain enterprise security tools including EDR, SIEM, email security, DNS filtering, and endpoint management platforms
- Monitor security alerts and events across the environment, performing triage, investigation, and escalation of potential incidents
- Manage and optimize detection rules, alerting thresholds, and automated response workflows within SIEM and EDR platforms
- Support the administration and enforcement of Conditional Access Policies, application control policies (AppLocker), and identity and access management configurations within Microsoft Entra ID (Azure AD)
- Assist with the deployment and management of mobile device management (MDM/MAM) policies through Microsoft Intune
- Conduct vulnerability assessments and coordinate remediation efforts with IT infrastructure and application teams
- Develop and maintain PowerShell or Python scripts to automate routine security tasks, reporting, and data collection
- Manage the end-to-end vulnerability management lifecycle - scanning, prioritization, remediation tracking, and validation across servers, endpoints, and cloud resources
- Coordinate and execute OS and third-party application patching across the environment, ensuring timely remediation of critical and high-severity vulnerabilities in alignment with established SLAs and maintenance windows
- Triage vulnerability scan results and prioritize remediation based on exploitability, asset criticality, and environmental context - not just raw CVSS scores - while developing compensating controls and risk acceptance documentation for vulnerabilities that cannot be immediately patched
- Monitor threat intelligence feeds and vendor advisories (Microsoft Patch Tuesday, CISA KEV catalog, vendor-specific bulletins) and track patching compliance metrics to support both proactive risk reduction and SOC 2 audit evidence requirements
- Participate in incident detection, investigation, containment, and remediation activities
- Perform log analysis and forensic investigation across endpoint, network, identity, and cloud environments
- Document incidents thoroughly, including root cause analysis, timeline reconstruction, and lessons learned
- Coordinate with the managed SOC provider on alert escalation, tuning requests, and incident handoff procedures
- Contribute to the development and testing of incident response playbooks and procedures
- Support the ongoing maintenance of SOC 2 Type 2 compliance, including evidence collection, control testing, and audit coordination through our compliance automation platform (Drata)
- Assist with the development, review, and enforcement of cybersecurity policies, standards, and procedures
- Contribute to vendor security assessments and due diligence reviews as part of our vendor risk management program
- Support Business Continuity Plan (BCP) documentation, tabletop exercises, and testing activities
- Help prepare materials and reporting for the Cyber Risk Steering Committee (CRSC) and other governance bodies
- Support the development and delivery of security awareness training and phishing simulation campaigns
- Serve as a knowledgeable security resource for IT colleagues and the broader organization, translating technical concepts into clear, actionable guidance
- Collaborate with cross-functional teams including IT infrastructure, compliance, and risk management to integrate security into business processes
Requirements:
- 5 - 7 years of hands-on experience in cybersecurity engineering, security operations, or a closely related technical security role
- Strong working knowledge of Microsoft Azure and M365 security capabilities, including Entra ID (Azure AD), Conditional Access, Defender suite, and Purview
- Experience deploying, managing, and tuning EDR platforms (e.g., SentinelOne, CrowdStrike, Microsoft Defender for Endpoint)
- Experience with SIEM platforms - log ingestion, correlation rule development, alert tuning, and dashboard creation (e.g., FortiSIEM, Sentinel, Splunk, or comparable)
- Demonstrated experience managing enterprise patching programs across Windows endpoints and servers, with familiarity in patch management tooling (e.g., WSUS, Intune, SCCM/MECM, or third-party solutions)
- Hands-on experience with vulnerability scanning platforms (e.g., Tenable, Qualys, Rapid7) including scan configuration, result analysis, and remediation workflow management
- Ability to assess and prioritize vulnerabilities using contextual risk factors beyond raw CVSS scores, including asset exposure, exploit availability, and business impact
- Solid understanding of identity and access management concepts including MFA, SSO, RBAC, and privileged access management
- Familiarity with endpoint management tools such as Microsoft Intune and application control technologies like AppLocker
- Experience with vulnerability management tools and processes (e.g., Tenable, Qualys, Rapid7)
- Working knowledge of common security frameworks and standards (NIST CSF, CIS Controls, MITRE ATT&CK)
- Competency in scripting for automation and reporting (PowerShell preferred; Python a plus)
- Strong analytical and problem-solving skills with the ability to investigate complex security events across multiple data sources
- Excellent written and verbal communication skills - able to clearly explain technical security topics to both technical and non-technical audiences
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field - or equivalent practical experience
- Experience working in financial services, wealth management, or another regulated industry
- Hands-on experience supporting SOC 2 audits, including evidence collection and control validation
- Experience with compliance automation platforms (e.g., Drata, Vanta)
- Familiarity with vendor risk management processes and third-party security assessments
- Experience coordinating with managed security service providers (MSSPs) or managed SOC teams
- Exposure to DNS filtering solutions (e.g., DNSFilter, Cisco Umbrella)
- Familiarity with business continuity and disaster recovery planning
- Understanding of SEC, FINRA, or other financial services regulatory requirements as they relate to cybersecurity