GXA is seeking a highly capable Security Engineer to support the delivery and operation of our gShield security services. This role is hands-on and technical, focused on incident response, security tool operations, remediation execution, client security support, and internal security improvement initiatives.

The Security Engineer serves as a Tier 3 escalation point for active security incidents and plays a key role in operating and improving the gShield security stack across client environments. This individual will work closely with the InfoSec Manager (vISM), vCISO, SOC, Centralized Services, onboarding teams, and internal technical leadership to strengthen client security posture and support rapid, effective response to threats.

This is an execution-focused role for someone who is comfortable working in live security events, analyzing alerts and evidence, supporting remediation efforts, and helping maintain the operational excellence of GXA’s security program.

Key Responsibilities

Incident Response

· Serve as a Tier 3 escalation point for active security incidents, including business email compromise (BEC), adversary-in-the-middle (AiTM), ransomware, and account compromise.

· Lead technical analysis during incident response and war room events, including log review, IOC hunting, and lateral movement tracing.

· Execute containment and eradication actions such as endpoint isolation, session revocation, and credential resets.

· Coordinate with SOC teams and vendor threat intelligence teams during active investigations and containment efforts.

· Produce accurate incident timelines, technical findings, and evidence packages for vCISO review and client-facing follow-up.

Tool Operations & Security Stack Support

· Operate daily within the gShield toolstack, including platforms such as Huntress, Microsoft Defender for Endpoint (MDE), Cyrisma, DNSFilter, SIEM, and related security technologies.

· Perform alert triage, risk identification, scan issue resolution, and follow-through on issues surfaced by security tools.

· Support SIEM operations including query development, alert review, and rule tuning.

· Assist in tuning detection logic, scan settings, and platform effectiveness in coordination with Centralized Services and security leadership.

· Monitor for security gaps, suspicious activity, and control weaknesses across managed environments.

· Work within established security standards, baselines, and operational policies defined by the security team and vITMs.

Client Delivery Support

· Execute technical remediation items identified through MRMMs, preventative actions, vulnerability reviews, and security recommendations.

· Support gShield deliverables through technical validation, evidence gathering, scan review, and vulnerability analysis.

· Act as a quality assurance resource for client onboarding into the gShield toolstack, while execution remains with onboarding and Centralized Services teams.

· Assist with client hardening efforts and follow-through on security improvement actions across managed environments.

Internal Security Posture

· Support remediation of internal GXA security backlog items, including POA&M-related work.

· Assist with rollout and support of phishing-resistant MFA, passkeys, and other internal security initiatives.

· Contribute to security engineering efforts related to Intune, Defender, ThreatLocker, AppLocker, and RMM scripting.

· Help improve internal security controls, tool effectiveness, and technical enforcement mechanisms.

Documentation & Process Improvement

· Write and maintain security engineering SOPs, runbooks, detection playbooks, and response procedures related to gShield operations and incident response.

· Document technical findings, repeatable procedures, and lessons learned from incidents and tool operations.

· Collaborate with security leadership and technical stakeholders on process improvements, skill development, and automation opportunities.

· Contribute technical depth to broader security documentation where needed, while recognizing that ownership of policy, standards, and governance documentation remains with security leadership and related functions.

Qualifications

· 5–7+ years of experience in cybersecurity, security operations, security engineering, or incident response roles.

· Strong hands-on experience with incident response, threat detection, and security operations workflows.

· Experience working with security platforms such as Microsoft Defender, Huntress, DNSFilter, SIEM solutions, vulnerability management tools, and endpoint security technologies.

· Ability to investigate security alerts, analyze logs, trace attacker activity, and support containment and remediation.

· Familiarity with common attack types including phishing, BEC, account compromise, ransomware, and identity-based attacks.

· Experience supporting security controls in Microsoft 365 and endpoint environments.

· Strong documentation skills and ability to write clear technical procedures and findings.

· Ability to work calmly and methodically during active incidents and escalations.

· Strong collaboration and communication skills with both internal teams and leadership stakeholders.

Preferred Qualifications

· Experience in an MSP, MSSP, or multi-client environment.

· Familiarity with Intune, Microsoft Defender, AppLocker, ThreatLocker, and RMM-based scripting or automation.

· Understanding of CIS benchmarks, security hardening standards, and configuration drift monitoring.

· Experience supporting vulnerability remediation and technical aspects of vCISO or managed security programs.

· Security certifications such as Security+, CySA+, SC-200, SC-300, AZ-500, GCIH, GCIA, or similar are a plus.

Success in This Role Looks Like

· Security incidents are handled quickly, accurately, and with strong technical discipline.

· Alerts and risks surfaced by the toolstack are investigated and acted on consistently.

· Client security remediation items are executed thoroughly and on time.

· gShield tooling is tuned, effective, and operationally reliable.

· Documentation, SOPs, and response playbooks are clear, useful, and continuously improving.

· Internal and client security posture improves through strong technical follow-through.

Requirements

PLEASE INCLUDE A LINK TO YOUR 1–2 MINUTE VIDEO INTRODUCTION IN YOUR COVER LETTER. APPLICATIONS WITHOUT A VIDEO LINK MAY NOT BE CONSIDERED, EXCEPT WHERE A REASONABLE ACCOMMODATION IS REQUESTED.