Cyber Engineer III

Seminole Hard Rock Support Services protects its guests, team members, and enterprise assets through cybersecurity practices. The Cyber Engineer III implements, operates, automates, and continuously improves security controls across systems, networks, cloud environments, and security operations, including using AI and large language models for detection, triage, and analysis.

Responsibilities:

• Deploy, configure, and tune endpoint and extended detection and response controls across Windows and Linux server and endpoint fleets, keeping coverage complete and policies current
• Operate identity threat detection and privileged-access protections, investigating and responding to identity-based threats
• Implement and automate certificate, PKI, secrets, and non-human / machine-identity lifecycles
• Maintain authoritative asset inventory and continuously reconcile attack-surface visibility across the environment
• Harden system configuration baselines and remediate drift in partnership with infrastructure and platform teams
• Configure and operate secure-access service edge, secure web gateway, CASB, and DLP controls, and enterprise remote access
• Manage edge and perimeter defenses: web application firewall, DDoS mitigation, and CDN policy, and API security posture and runtime protection
• Deploy and tune network detection and response, triaging anomalous activity and feeding findings to the SOC
• Operate the enterprise browser to enforce least-privilege, isolated access to sensitive applications via an enterprise browser platform
• Apply zero-trust segmentation and least-privilege access principles consistently across the network estate
• Implement and maintain cloud-native application protection and posture management across Azure (primary), AWS, and Google Cloud, remediating misconfigurations and preventing drift
• Govern SaaS security posture and contain non-human identity sprawl across the SaaS estate
• Operate data security posture, data access governance, and data discovery and classification across cloud and on-premises stores
• Implement cloud-native guardrails, least-privilege IAM, encryption, and logging baselines in partnership with cloud engineering
• Integrate security checks into infrastructure-as-code and deployment workflows so cloud workloads are secure by default
• Build and maintain security automations, integrations, and response playbooks across the stack using APIs and SOAR
• Engineer telemetry pipelines that route, shape, and enrich security data for cost-effective analysis, and develop and tune detections and SIEM content
• Leverage AI/ML and large language models to analyze large volumes of security data, accelerate alert triage and enrichment, surface anomalies, and automate reporting and documentation
• Develop and maintain production-grade scripts, services, and tooling (e.g., Python, PowerShell, Go) that operationalize security controls and eliminate repetitive manual work
• Instrument metrics and dashboards that make control coverage, detection efficacy, and remediation timeliness measurable
• Operate the vulnerability management lifecycle end-to-end: scanning, risk-based prioritization, tracking, and verification of remediation
• Coordinate penetration testing and manage findings through to closure
• Monitor external attack surface, threat exposure, and credential/brand leakage, and track third-party and vendor risk
• Operate email defenses, tuning detection and response for phishing and account-takeover threats
• Support security awareness and phishing-simulation programs with the data and integrations they need
• Partner with Cybersecurity Architecture, IAM, infrastructure, application, and SOC/MSSP teams to deploy controls consistently and resolve issues quickly
• Support GRC, audit, and privacy programs by automating evidence collection and continuous control monitoring
• Document standards, runbooks, integration designs, and operating procedures so controls are repeatable and supportable
• Research, prototype, and pilot emerging tools and AI-driven capabilities that improve detection, automation, and analyst efficiency
• Participate in an on-call rotation and incident response for a 24/7 gaming and hospitality environment

Requirements:

• 5–7+ years of combined experience in cybersecurity engineering, systems / network / cloud administration, or software / platform engineering, with at least 4+ years focused on hands-on security engineering in enterprise environments
• Strong software development proficiency, with hands-on experience in Python, PowerShell, Go, or similar languages, and the ability to build custom security tooling, integrations, and automation from scratch
• Deep infrastructure and systems expertise, with hands-on experience securing and operating workloads across IaaS, PaaS, and containerized (Docker, Kubernetes) environments on Microsoft Azure (required), with working experience in AWS and/or Google Cloud, across Linux and Windows
• Practical experience applying AI/ML or large language models to security data analysis, detection, triage, or automation
• Strong working knowledge of endpoint / XDR, identity and privileged access, network security (proxies, VPN, WAF, NDR, API security), and cloud security posture management
• Solid grasp of the vulnerability management lifecycle end-to-end, plus exposure and third-party risk monitoring
• Deep networking and systems fundamentals: TCP/IP, DNS, TLS/PKI, firewalls, segmentation, and zero-trust access models
• Experience integrating security tools and data sources via API, with familiarity in SOAR and SIEM content development
• Translate security requirements and architecture into deployed, automated controls that operate reliably and integrate cleanly into existing systems and workflows, without creating friction
• Operate as a hands-on engineer who personally builds, configures, tests, and ships high-quality automation and integrations, measuring success in problems solved, not tickets closed
• Troubleshoot methodically across systems, network, and cloud layers, isolating root cause under time pressure during incidents
• Collaborate effectively across cross-functional teams: cybersecurity, software development, cloud and infrastructure engineering, IAM, compliance, and the SOC
• Communicate technical findings and recommendations clearly to both technical peers and non-technical stakeholders
• Thrive in an Agile, fast-paced environment that values automation, rapid iteration, and measurable security outcomes over manual process
• Demonstrate a builder's mindset and a passion for using engineering and AI to make security faster, more consistent, and more scalable
• Familiarity with regulatory and compliance frameworks relevant to gaming and hospitality (PCI-DSS, SOX, tribal gaming regulations, GLBA), preferred but not required
• Relevant certifications preferred: CompTIA Security+, Microsoft SC-series or AZ-500, AWS Security Specialty, Google Professional Cloud Security Engineer, GIAC (GCIH, GCSA, GCLD), Certified Kubernetes Security Specialist (CKS), or equivalent
• CISSP a plus