Senior Cybersecurity Engineer – Security Operations & Data Protection

Bennett Thrasher is looking for Senior Cybersecurity Engineer to own day-to-day security, including the safe use of AI tools, for multiple offices. You will be the firm's lead security practitioner - directing our managed detection and response (MDR) partner, running our data security platform, setting the security requirements and guardrails for our AI tools, and making the daily access and risk decisions that protect client financial data.

You will work alongside our Microsoft 365 Administrator, who implements and operates the Microsoft security and compliance configuration (Purview, Defender, Entra ID, and Intune). Additionally, you’ll define the requirements, approve exceptions, and verify the results; the administrator builds and runs the configuration.

WHAT YOU'll DO:

Detection and response

• Direct the firm's MDR provider: tune alerts, build and maintain playbooks, and own integrations with firm systems.
• Lead incident response, coordinating the MDR provider, IT leadership, and outside parties.
• Oversee vulnerability and patch management delivered through the MDR service.
• Review detections and response actions with the MDR provider and the Microsoft 365 Administrator, who maintains the endpoint protection configuration.

Data security

• Administer the DSPM platform: permissions, data classification, alerting, and remediation of overexposed data.
• Set least-privilege standards across Microsoft 365 and firm file systems, and verify they are enforced.
• Set data loss prevention, retention, and sensitivity-labeling requirements with Compliance. The Microsoft 365 Administrator implements them in Purview, and you review and approve the results.

Daily security operations

• Decide on escalated security requests: access exceptions, phishing reports that go beyond first-line triage, and security reviews of new software and vendors.
• Write and maintain the runbooks the service desk uses for first-line security triage, and coach the desk to resolve routine requests without escalation.
• Advise the service desk and systems team on security questions and escalations.

AI security

• Define the security requirements for the firm's generative AI tools, including Microsoft Copilot (data loss prevention, access controls, and usage monitoring), and verify they are in place. The Microsoft 365 Administrator configures the Microsoft-side controls.
• Own the AI guardrail capabilities outside Microsoft 365, including our secure access platform, and help evaluate any additional AI guardrail software.
• Turn the firm's AI usage policy into enforceable controls, working with the owners of AI governance.

Vendor and network oversight

• Serve as the primary contact for security vendors, and manage their performance, renewals, and roadmaps.
• Set security requirements for the Cisco network (firewalls, segmentation, VPN, wireless) and review changes made by the managed network partner.

Compliance

• Serve as control owner for assigned security controls in the firm's annual SOC 2 Type II audit: maintain control effectiveness throughout the audit period, provide evidence to auditors, and remediate any exceptions identified.
• Review and approve changes to security controls made by others, keeping configuration and approval separate for audit purposes.
• Develop, maintain, and regularly review security policies, procedures, and runbooks so they reflect current threats, technologies, and compliance requirements.

WHAT YOU'll BRING:

• 7+ years in IT security, including at least 3 in a security engineering role.
• Hands-on experience working with an MDR or SOC provider: alert tuning, playbook development, and EDR or SIEM integrations.
• Experience running a data security or data governance platform.
• Solid Microsoft 365 security knowledge (Entra ID, Conditional Access, Defender, Purview, and Intune), enough to design policy, set requirements, and review an administrator's work.
• Working knowledge of Cisco firewalls, VPN, and network segmentation, enough to set requirements and review a partner's work.
• Experience leading incident response from detection through post-incident review.
• Experience supporting SOC 2 or a comparable audit as a control owner.
• Experience managing security vendors and service providers, including holding them accountable to contracted scope, deliverables, and service level agreements (SLAs).
• Clear communication with non-technical staff and firm leadership, and sound judgment on risk trade-offs.

Nice to have:

• CISSP, CISM, or a GIAC certification.
• Familiarity with tools and controls for securing generative AI, including Microsoft Purview (DLP, sensitivity labels, DSPM for AI), Defender for Cloud Apps and Entra Conditional Access, and awareness of AI-specific risks such as data leakage and prompt injection.
• Background in accounting, professional services, or financial services.
• Azure security experience.
• Scripting for automation in PowerShell or Python.
• CCNA as well or Network +