Information Security Associate Engineer

EMPLOYERS is a provider of workers' compensation insurance and services. The Information Security Associate Engineer will help protect applications, infrastructure, data, and cloud environments by monitoring security tooling, managing vulnerabilities, supporting IAM and cloud security, responding to incidents, and improving security controls.

Responsibilities:

• Monitor security alerts, logs, and dashboards (SIEM/SOAR) to identify, triage, and escalate potential security incidents
• Assist in performing vulnerability assessments and coordinate remediation of findings across applications, infrastructure, and cloud resources
• Support the configuration, hardening, and maintenance of cloud environments (AWS, Azure), including identity, network, storage, and workload security controls
• Use cloud security posture management (CSPM) and cloud-native tools to detect misconfigurations, excessive permissions, and non-compliant resources
• Support identity and access management (IAM) activities, including access reviews, role-based access control (RBAC), and least-privilege enforcement
• Assist with incident response activities, including evidence gathering, containment support, and documentation of findings and timelines
• Develop and maintain technical security documentation, including runbooks, diagrams, playbooks, and standard operating procedures
• Support security control implementation aligned to frameworks such as NIST CSF, ISO 27001, or CIS Benchmarks
• Assist with risk assessments, helping identify, document, and prioritize security risks across systems, applications, and cloud environments
• Participate in code and architecture reviews to identify security weaknesses and recommend secure design practices (e.g., OWASP Top 10)
• Assist with encryption key management, secrets management, and secure configuration of data at rest and in transit
• Support patch management and endpoint protection efforts across servers, workstations, and cloud workloads
• Contribute to security awareness efforts and provide guidance to internal teams on secure development and operational practices
• Stay current on emerging threats, attacker techniques, cloud security best practices, and evolving compliance requirements
• Share technical knowledge and mentor team members to support collaborative learning and continuous improvement
• Analyze security metrics and reports to validate that controls meet defined risk, reliability, and service-level goals
• Other duties as assigned

Requirements:

• 0-3 years of experience in information security, IT security, or a related technical field
• Bachelor's degree in computer science, cybersecurity, information systems, or a related field, or equivalent experience
• Equivalent combinations of education and experience may be considered
• Exposure to cloud security concepts and at least one major cloud provider (AWS or Azure), including shared responsibility model concepts
• Basic understanding of risk assessment concepts, including identifying, rating, and prioritizing risk based on likelihood and impact
• Familiarity with security tools such as SIEM, vulnerability scanners, endpoint detection and response (EDR), or cloud-native security services
• Basic understanding of networking concepts (firewalls, VPNs, segmentation, DNS) and common attack techniques
• Familiarity with identity and access management concepts, including MFA, SSO, and role-based access control
• Proficiency or working knowledge of at least one scripting or programming language (e.g., Python, PowerShell, Bash) for automation and analysis
• Knowledge of common security and compliance frameworks (e.g., NIST CSF, ISO 27001, CIS Controls, SOC 2)
• Exposure to Windows and Unix-variant operating systems in a security or administrative context
• Ability to discuss technical security concepts clearly with non-technical stakeholders, ensuring mutual understanding
• Ability to excel in a fast-paced, evolving threat landscape, managing ambiguity and adapting to change
• Capable of working with minimal supervision while staying motivated and focused on tasks and objectives
• Must be detail-oriented, able to approach problems with a logical, systematic, and security-first mindset
• Strong written and verbal communication skills, able to convey technical and risk information clearly and professionally
• Strong analytical and problem-solving skills with the ability to absorb new information rapidly and apply it to security investigations
• open to candidates currently located in the United States who are able to work without sponsorship
• Security-related certification preferred, such as CompTIA Security+, Systems Security Certified Practitioner (SSCP), or an equivalent entry-level credential
• Cloud security certification preferred, such as AWS Certified Security – Specialty or Microsoft Certified: Azure Security Engineer Associate