Information Security Engineer

City Bank seeks an Information Security Engineer to design, implement, operate, and continuously improve its information security program. The role secures enterprise systems and manages security operations, threat and vulnerability management, identity and access management, incident response, cloud security, and AI governance.

Responsibilities:

• Security Engineering & Operations - Design, implement, and maintain enterprise security controls and technologies. Monitor security systems, analyze logs and alerts, and perform investigations. Continuously improve detection and response capabilities
• Threat and Vulnerability Management - Perform vulnerability scanning, threat monitoring, and risk analysis. Prioritize, track, and coordinate remediation activities with IT and business stakeholders
• Incident Response - Lead incident response activities, including investigation, containment, eradication, and recovery. Perform forensic analysis and document findings. Participate in after-hours response as needed
• Identity & Access Management - Own and administer the Bank’s Identity and Access Management (IAM) program. Design and enforce identity governance, provisioning, deprovisioning, authentication, and authorization controls. Manage role-based access models, privileged access management, and identity lifecycle processes. Ensure access decisions align with least privilege and regulatory expectations. Oversee access certifications and continuously improve identity control effectiveness
• AI Governance & Emerging Technology Risk - Support and administer governance processes for AI systems and tools used within the Bank. Maintain inventory, risk classification, and monitoring of AI agents and solutions. Ensure alignment with internal policies, regulatory expectations, and model risk management requirements. Collaborate with stakeholders to evaluate and onboard new AI use cases securely
• Cloud Security - Design, implement, and maintain cloud security controls aligned with the Bank’s architecture. Monitor cloud environments for misconfigurations, threats, and compliance issues
• Security Tools Administration - Administer and optimize security technologies, including firewalls, endpoint security platforms, and related tools. Evaluate and implement new security solutions as needed
• Data Governance & Retention - Support oversight of data protection, classification, and retention practices. Assist in the management and reporting of tools supporting data governance
• Data Analysis & Reporting - Develop and present security metrics, dashboards, and reports for leadership, committees, and auditors. Support risk reporting and program maturity tracking
• Security Awareness & Training - Support the development and execution of security awareness and training programs. Track effectiveness and recommend improvements
• Vendor Management - Participate in vendor onboarding, risk assessments, and ongoing monitoring activities. Support administration of vendor risk management tools
• Business Continuity Planning - Support business continuity and disaster recovery planning, testing, and improvement efforts