Cyber Security Engineer

The Security Engineer is an early-career engineering role within the Cyber Operations team, working across multiple security disciplines under the direction of senior engineers and the Director, Cybersecurity Operations. This is a hands-on technical position executing real security work across detection and incident response support, vulnerability management, security engineering, and compliance evidence. The role sits at the entry point of KLDiscovery's security engineering track, with a clear progression path toward Sr. Security Engineer and Principal Security Engineer as domain ownership and independent execution capability are demonstrated.

We offer competitive total compensation that includes base pay, bonus potential, inclusive benefits, wellness programs, and perks. We use market and industry data to inform pay decisions while considering geography and labor markets, individual experience, and business needs. Individual compensation will vary, although a reasonable estimate of the current annualized base pay range for this position is $100,000 to $220,000.

Key Responsibilities

Security Operations & Incident Response Support

• Contribute to detection engineering, writing, testing, and tuning SIEM detection rules and SOAR playbooks to improve the team's ability to identify and respond to threats automatically
• Support the SOC/IR function by validating and escalating CrowdStrike MDR-confirmed findings, ensuring accurate triage and appropriate internal escalation
• Assist with incident response activities like evidence collection, timeline reconstruction, containment actions, and post-incident documentation
• Monitor and respond to security alerts from tools operating outside MDR scope
• Contribute to SIEM and identity health monitoring flagging anomalies, reviewing detection coverage, and supporting SOAR playbook testing

Vulnerability Management Support

• Own the vulnerability and exposure management program mechanics setting remediation SLA thresholds, driving prioritization decisions, and producing executive reporting on vulnerability posture
• Monitor and interpret real-time vulnerability and exposure findings from CrowdStrike Falcon Exposure Management, triaging findings, assessing risk, and prioritizing remediation based on exploitability and business impact
• Track and assess patch deployment failures, identifying systems where patches have not applied successfully, escalating gaps, and working with IT to drive remediation to closure
• Coordinate third-party penetration testing engagements by confirming scope, scheduling, internal stakeholder liaison, and tracking remediation of identified findings through to closure
• Maintain accurate exposure and remediation tracking records to support compliance evidence and executive reporting on vulnerability posture

Security Engineering Support

• Assist with security architecture reviews for technology projects by reviewing requirements, identifying gaps, and documenting findings for senior engineer review
• Support configuration and maintenance of security tooling across endpoint, identity, cloud, and application security platforms
• Contribute to automation efforts: scripting, playbook testing, IaC security gate tasks, and CI/CD pipeline security support as directed
• Assist with documentation of security standards, runbooks, and technical procedures to support audit readiness and knowledge transfer

AI Security

• Develop foundational awareness of AI security considerations including AI tool access governance, anomalous AI activity triage, and emerging AI risk patterns
• Support team-wide AI security responsibilities within your functional lane as directed by senior engineers
• Triage alerts involving AI tool misuse or anomalous AI-related activity as part of the analyst support function

Compliance & Audit Support

• Gather and maintain evidence for compliance frameworks, including the verification of internal security control implementation
• Support the GRC team with technical control documentation, evidence quality review, and gap remediation tracking
• Standardize documentation practices to ensure security evidence is always audit-ready, not reconstructed at assessment time

Qualifications

Experience

• 3+ years of hands-on experience in information security, IT engineering, or a closely related technical field
• Experience with at least one of the following: SIEM platforms, vulnerability scanning tools, endpoint security (EDR/XDR), or cloud security tooling
• Experience with log analysis, alert triage, or security monitoring in a corporate environment
• Familiarity with scripting (Python, PowerShell, or Bash) for automation or reporting tasks is a meaningful differentiator
• Experience with MDR platforms (CrowdStrike Falcon Complete or equivalent) is a plus but not required

Technical Knowledge

• Understanding of core security domains sufficient to execute assigned tasks independently: access management, encryption, network security, vulnerability management, and incident response
• Basic familiarity with cloud security concepts (AWS, Azure, or GCP) including IAM, logging, and posture monitoring
• Foundational understanding of AppSec concepts is a meaningful differentiator: SAST/DAST tooling, secure SDLC, and pipeline security
• Experience with AI security considerations (AI tool access governance, prompt injection awareness) is a plus

General Abilities

• A strong sense of ownership, when you take on a task, it gets done; you follow through without being chased, flag blockers early, and close the loop reliably
• Alert and attentive, you notice things others miss, take monitoring seriously, and understand that complacency in security operations has real consequences
• Detail-oriented with high standards for accuracy and you take documentation, evidence, and configuration tasks seriously
• A strong communicator, able to write clear technical documentation and summarize findings clearly for non-technical colleagues
• A collaborative team member, you contribute to a team environment where senior engineers mentor you and you are expected to share what you learn
• Growth-oriented, you actively seek feedback, invest in your own development, and approach mistakes as learning opportunities
• Discreet and trusted, you handle sensitive security findings, incident data, and client-related information with appropriate confidentiality

Education

• Formal education in Information Security, Computer Science, IT, or a related field is a plus but not required
• Relevant certifications such as GSEC or CISSP are valued but not a prerequisite. If you don't have one yet, we'll support you in getting there