IT Security Engineer

SWCA Environmental Consultants is a growing employee-owned firm providing a full spectrum of environmental services. The IT Security Engineer is responsible for the day-to-day security operations, including incident response, identity and access management, and risk assessment, while continuously improving security practices and automation.

Responsibilities:

• Monitors security alerts and events from outsourced MDR service and SIEM, EDR, email and other detection tools; triages, investigates, and responds to security incidents in accordance with standards, policies, best practices, and where applicable, established playbooks
• Leads or supports incident response activities including containment, eradication, recovery, and post-incident documentation
• Maintains and improves incident response playbooks, contributes to after-action reviews, lessons-learned processes, and continued improvement
• Acts as an initial escalation point for security-related support tickets, working through the internal ticketing system to review, prioritize, and coordinate response to issues that require deeper technical investigation, risk evaluation, or security team involvement (Freshservice, ServiceNow, etc.)
• Operates and maintains the vulnerability scanning program, with outsourced vendor support where applicable, across enterprise systems, cloud environments, and endpoints; tracks findings and coordinates remediation with security and IT teams
• Monitors threat intelligence feeds and communicates relevant emerging threats, indicators of compromise, and attacker techniques to the security team and leadership
• Prioritizes and tracks vulnerability remediation by severity, asset criticality, and risk exposure; reports program status and trends to the Security Manager
• Administers and monitors identity and access controls across the enterprise including Entra ID, remote access authentication, role-based access control, privileged access management, and conditional access policies
• Conducts regular access reviews and maintains appropriate documentation
• Supports onboarding and offboarding processes to ensure access is provisioned and deprovisioned accurately and in a timely manner
• Evaluates new hardware, software, and cloud services for security risk prior to procurement or deployment; provides risk assessment findings and recommendations to appropriate IT leadership
• Contributes to vendor security assessments in coordination with the Security & Compliance Manager
• Maintains a risk register for assessed technologies; tracks remediation commitments and monitors for changes in risk posture over time
• Designs, implements, and maintains automation workflows to streamline security operations, particularly in areas such as alert triage, enrichment, response, and vulnerability tracking
• Leverages scripting, APIs, and orchestration tools to reduce manual effort, improve consistency, and increase the speed of response
• Leverages AI and automation to support post-escalation security workflows and operational response activities
• Integrates security tools across the enterprise to enable coordinated response and improved visibility across systems
• Identifies opportunities to improve efficiency and scalability of security processes through engineering and automation-first thinking
• Defines, tracks, and reports on key security operations metrics such as response times, alert quality, and remediation performance
• Uses operational data and trends to continuously improve detection coverage, response effectiveness, and overall program maturity
• Works cross-functionally with IT, engineering, and business teams to embed security practices into enterprise systems and processes
• Communicates risks, findings, and recommendations clearly to both technical and non-technical stakeholders

Requirements:

• Bachelor's degree in Cybersecurity, Information Technology, or a related field. Equivalent experience and certifications considered
• At least three (3) years of hands-on information security experience, with demonstrated involvement in incident response, IAM, or vulnerability management
• Proficiency with SIEM platforms, EDR tools (CrowdStrike, SentinelOne, etc.), and identity security in a Microsoft 365 / Azure environment
• Working knowledge of identity and access management principles and tools (Entra ID, Active Directory, PAM solutions)
• At least five (5) years of hands-on information security experience, with demonstrated involvement in incident response, IAM, or vulnerability management
• Experience supporting or securing cloud and SaaS environments
• Experience with security automation using scripting and API integrations
• Familiarity with integrating security tools and automating operational workflows
• Exposure to AI/ML or generative AI applications in cybersecurity operations, including the use of AI agents to automate or augment functional responsibilities
• Certification in CompTIA Security+, CySA+, SC-200, or equivalent. CISSP, CEH, GCIH, or other incident response certifications valued