Security Engineer, Technical Assurance

Security Engineer, Technical Assurance

Manhattan, hybrid. NYC metro only.

If you’re the security engineer on a small team, you know what this job is before I describe it.

You’re the one who gets the Slack message asking if a tool is safe to buy. You read the vendor’s SOC 2, you spin the thing up and poke at it yourself, you then tell Legal what to push back on, and then you go patch the proxy because nobody else is going to. You do a little of everything because there’s nobody to hand it to.

That’s the role. The difference is the scale of what you’re protecting.

What the week looks like.

• HR wants a platform that will hold employee data. You pull the vendor’s SOC 2 and catch that the observation window is three months and the scope skips the system that would actually hold the data. Then you test the product yourself, because “we enforce MFA” is a claim until you’ve tried to get around it. You write it up in plain English and you’re in the room when they decide.
• A CVE that just dropped and figuring out whether it’s reachable here or just a scary number.
• Tune DLP so it stops firing on every spreadsheet.
• Scope an outside pen test and running the remediation after.

Roughly 40% risk and vendor reviews, 30% hands-on validation, 20% keeping the security stack healthy, the rest investigations and reporting.

Can you test whether a control actually works, with your own hands, not by reading a scanner report. And can you tell what a piece of vendor evidence is really worth. Everything else is teachable and they’ll teach it.

The stack is Splunk, CrowdStrike, Netskope, Qualys, Gurucul, Symantec ProxySG, Swimlane, and BlinkOps. Nobody has all eight. Don’t screen yourself out over a platform.

7+ years in security with real keyboard time. NIST CSF, 800-53, CIS, MITRE ATT&CK. CISSP, CISA, CRISC, GSEC, GCIH, GPEN, or OSCP all count.