Security Engineering & Vulnerability Management Lead

ob Description

Role summary: Owns WWC's technical security controls, vulnerability management and penetration testing. Hardens the Microsoft 365 A5, Entra ID, Intune and Jamf, network and Colleague SQL environment, and turns scan and test findings into a prioritized remediation plan for WWC's systems/network administrators.
Reports to: vCISO
Works with: WWC systems/network administrators, Colleague application support, SOC & IR Lead
Location: US-based; remote, with onsite visits to Rock Springs and Green River for internal network and wireless testing
Allocation: 0.3–0.5 FTE; project surges for annual penetration testing
Key responsibilities:
• Run continuous vulnerability scanning and assessments of external and internal networks, servers, endpoints, web applications and cloud tenants.
• Lead annual external and internal penetration testing (network, web application, wireless, social engineering) and remediation retesting.
• Deliver vulnerability remediation recommendations ranked by risk and track remediation with WWC IT staff to closure.
• Run the cloud security evaluation and hardening of Microsoft 365 A5: Defender for Endpoint, Office 365 and Identity; Entra ID Conditional Access and MFA; Purview; Secure Score; CIS benchmarks.
• Harden endpoint and device management in Intune (Windows) and Jamf (macOS), including patch, encryption and configuration baselines.
• Review firewall, switch, wireless and server configurations; recommend network segmentation (student, staff, administrative and Colleague SQL zones).
• Assess Ellucian Colleague (on-prem SQL) and Canvas integration security: identity, privileged access, database hardening and backups.
• Review backup and recovery architecture to support disaster recovery and ransomware resilience.
Deliverables owned: vulnerability assessment reports, penetration test reports with an executive summary, the vulnerability remediation plan and tracker, the M365/cloud security assessment, and security configuration baselines.

Skill set info

Experience: 12+ years in security engineering, infrastructure security or offensive security
Required qualifications:
• 12+ years in information security engineering, including 5+ years running vulnerability management and penetration testing programs.
• Expert in Microsoft 365 / Azure security (Defender, Entra ID, Intune, Purview) and Jamf administration or hardening.
• Hands-on with Tenable, Qualys or Rapid7, plus Burp Suite, Nmap and Metasploit.
• Experience hardening Windows Server, SQL Server, firewalls (Palo Alto, Fortinet or Cisco) and wireless networks.
• Bachelor's degree in Cybersecurity, Computer Science or Engineering, or equivalent experience.
Preferred: penetration testing and hardening experience in colleges, universities or the public sector.

Education

Bachelor's degree in Cybersecurity, Computer Science or Engineering, or equivalent experience.

Certifications (if required)

Certifications (required: at least one of): OSCP, GIAC GPEN or GWAPT, CISSP. Preferred: Microsoft SC-100 or AZ-500, CompTIA PenTest+, CCNP Security, Jamf Certified Admin.