Watsco Inc. is the largest distributor of air conditioning, heating and refrigeration equipment and related parts and supplies in the HVAC/R distribution industry. We serve over 125,000 contractor-customers through our nearly 700 locations where more than 7,400 team members bring essential, sustainable comfort to families and businesses across the Americas. At Watsco, we recognize our responsibility to help drive the transition to a lower carbon future. That’s why we are committed to providing high efficiency, low carbon HVAC equipment and energy-saving parts and supplies to households and businesses across the Americas. Since January 2020, Watsco’s sales of high efficiency equipment has reduced future CO2e emissions by over 19.2 M MT. Learn more about our impact and how you can become part of this transformation at www.watsco.com/environment
Position Summary
Seeking a Security Engineer to operate and continuously improve cybersecurity monitoring, incident response, vulnerability management, email and endpoint security, cloud and identity controls, risk, and security assurance. This role partners with IT owners and an MDR provider to reduce risk while maintaining independent review of security controls.
Key Responsibilities
- Operate or oversee SIEM, EDR, email-security, identity, cloud, and MDR monitoring; investigate alerts, tune detections, validate logging coverage, and escalate material events.
- Lead technical incident response, including triage, containment, evidence preservation, partner coordination, recovery support, post-incident review, and corrective-action tracking.
- Run the vulnerability-management program: maintain scan coverage, risk-rank findings, assign remediation, manage time-bound exceptions, rescan, and report overdue exposure.
- Administer Proofpoint security policy and investigate phishing; manage blocking, whitelisting, impersonation protection, SPF/DKIM/DMARC coordination, and security-related release escalations.
- Define and validate MFA, SSPR, Conditional Access, privileged access, account recovery, access review, and compromised-account requirements in partnership with Infrastructure.
- Define endpoint/server hardening, EDR, encryption, logging, and isolation requirements; validate remediation performed by Service Delivery and Infrastructure.
- Review segmentation, firewall rules, remote access, cloud configurations, internet-facing services, new applications, architectures, and significant technology changes.
- Maintain security policies, standards, risk register, exceptions, metrics, audit evidence, customer/security questionnaires, cyber-insurance support, and remediation plans.
- Assess critical vendors, partner access, SaaS/cloud services, contractual security requirements, and third-party remediation.
- Deliver role-based awareness, phishing exercises, incident runbooks, tabletops, and cross-training; coordinate MDR, forensic, penetration-testing, and specialist partners.
Required Qualifications
- 4+ years of cybersecurity engineering, security operations, incident response, vulnerability management, or equivalent defensive-security experience.
- Hands-on knowledge of SIEM, EDR, email security, identity and cloud security, vulnerability scanning, network security, Windows environments, and incident investigation.
- Ability to analyze logs and alerts, communicate risk clearly, preserve evidence, write policies/runbooks, and coordinate technical remediation across owners and vendors.
- Working knowledge of common security frameworks and controls, least privilege, segmentation, secure configuration, risk treatment, and audit evidence.
- Ability to participate in after-hours incident response and handle sensitive information with discretion.
Preferred Qualifications
- Experience with Microsoft Defender, Entra ID, Microsoft 365, Proofpoint, cloud security, MDR/SOC operations, scripting, and multi-site environments.
- Relevant Security+, CySA+, GCIH, GCIA, CISSP, CCSP, Microsoft Security, or comparable certification.
- Experience with NIST CSF, CIS Controls, ISO 27001, PCI DSS, privacy obligations, or customer assurance programs as applicable.
Working Conditions This role may require scheduled after-hours work, participation in incident response, and local travel as stated above. Duties may evolve with business needs. Reasonable accommodations will be provided in accordance with applicable requirements.