About The Role:

What You’ll Do:

• Day-to-Day
• Advance the detection and response program at a strategic level, leading coverage across Cloud, SaaS, Endpoint, and Identity domains.
• Implement organization-wide automation approaches that reduce alert fatigue and accelerate response across all security tooling.
• Continuously mature SIEM and cloud-native logging architectures, ensuring a highly functional, cost-aware telemetry pipeline spanning corporate, manufacturing, and engineering environments.
• Define and implement scalable security controls that strengthen cloud and infrastructure security through detection, configuration standards, and automated enforcement.
• Drive long-term improvements to cloud and infrastructure security posture through measurable, repeatable, and auditable security processes.
• Ensure 24/7 network operational coverage through on-call rotation and escalation protocols.
• Security Tool Management
• Own end-to-end lifecycle management of the enterprise security toolset including, deployment, configuration, tuning, and decommissioning.
• SIEM platforms, Endpoint Detection and Response (EDR)/Extended Detection and Response (XDR) tools, vulnerability scanners
• Network Traffic Visibility solutions
• Manage SIEM operations including data source onboarding, log normalization, correlation rule development, and alert tuning to minimize noise and maximize fidelity.
• Develop and enforce network device hardening standards across all managed security platforms.
• Team Leadership and Vendor Management
• Lead, mentor, and develop internal technical resources and external security vendors, holding all parties accountable to defined SLAs, quality standards, and security outcomes.
• Serve as the primary escalation point for internal team members and external vendor partners during incidents, complex technical issues, and project delivery challenges.
• Partner with managed security service providers (MSSPs) and specialized security vendors to extend team capabilities, conducting regular performance reviews and contract evaluations.
• Influence and mentor engineers across cross-functional teams, raising the overall bar for detection engineering, automation, and cloud security practices.
• Interface with IT leadership, security management, and vendors to develop and implement new solutions that meet evolving business and regulatory requirements.
• Cloud Security and Posture
• Define and enforce cloud security best practices across all cloud workloads, accounts, and organizational units, including IAM least-privilege, resource policy governance, and guardrail enforcement via SCPs.
• Lead implementation and continuous tuning of cloud security services.
• Partner with cloud infrastructure and platform engineering teams to embed security controls into CI/CD pipelines, infrastructure-as-code (IaC) templates, and cloud “landing zone” designs.
• Design and maintain cloud network security architecture including VPC segmentation, security group standards, PrivateLink, WAF rulesets, and configurations.
• Define cloud security configuration standards (CIS Benchmarks, Security Best Practices) and implement automated compliance enforcement via controls.
• Govern IAM strategy across cloud environments, enforcing role-based access, MFA requirements, and service control policies.
• Network Security
• Participate in the design and enforcement of network security policies, including firewall rule management, zero-trust network access (ZTNA), network access control (NAC), and micro-segmentation.
• Oversee network vulnerability assessments and penetration test scoping; ensure timely remediation and deliver clear risk assessment reports to stakeholders.
• Support compliance activities (e.g., NIST, SOC 2, ISO 27001, etc.) through network controls documentation, audit evidence, and remediation execution.
• Create management processes to keep all network equipment current and hardened against known vulnerabilities.
• Threat Detection and Incident Response
• Manage the technical direction for threat detection and response capabilities across SIEM, cloud-native security platforms, and adjacent security tooling.
• Lead threat-model–driven detection strategy, identifying high-risk attack paths and ensuring detection coverage across cloud, SaaS, endpoint, and identity domains.
• Serve as a senior escalation point during complex security incidents, driving technical analysis, coordinating response across teams, and guiding post-incident remediation.
• Identify systemic gaps in detection coverage, telemetry ingestion, and automation logic; lead cross-team efforts to close gaps at scale.
• Implement and mature playbooks that reduce mean time to detect (MTTD) and mean time to respond (MTTR) across the security operations function.
• Analyze network traffic, system logs, and cloud telemetry to identify anomalies, confirm threats, and support security controls validation.
• OT/ICS and Manufacturing Security
• Conduct operational technology (OT) cybersecurity assessments, identifying risks, potential impacts, and prioritized remediation recommendations.
• Design and support implementation of network segmentation strategies for OT/IT convergence environments, including segmented Industrial Control System networks.
• Collaborate with internal engineering and operations teams to assess security posture without disrupting production operations.
• Identify and implement appropriate remote and local access controls for manufacturing systems.
• Architecture and Engineering Standards
• Own, develop, and maintain architectural standards including reference architectures, data flow diagrams, detection pipeline operating models, and security design patterns.
• Design cybersecurity solutions supporting network segmentation, remote and local access controls, and advanced intrusion detection/prevention systems.
• Partner with IT infrastructure, platform, and engineering teams to ensure security is embedded into cloud design, IAM strategy, and network architecture from inception.
• Drive long-term improvements to cloud and infrastructure security posture through scalable detection, configuration standards, and automation.
• Fulfill project requests to support management and mitigation of vulnerabilities across the enterprise environment.
• Policy, Compliance and Governance
• Develop, maintain, and communicate security policies, plans, and procedures in alignment with applicable regulatory requirements (NIST, SOC 2, ISO 27001, as applicable).
• Provide administrative-level technical oversight across network security operations, ensuring audit-readiness and evidence collection for compliance assessments.
• Produce clear, stakeholder-ready risk articulations for identified vulnerabilities and architectural weaknesses, including impact assessments and recommended mitigations.

What You’ll Need:

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or related technical field. Equivalent combination of education and experience considered.
• 8+ years of progressive cybersecurity engineering experience, with at least 2–3 years in a technical lead or people management capacity.
• Demonstrated experience managing both internal security engineers and external vendors/MSSPs, with accountability for security outcomes and SLA adherence.
• Hands-on expertise with enterprise SIEM platforms (Splunk, Sentinel, Chronicle, or equivalent) including detection rule authoring, data onboarding, and operational tuning.
• Deep working knowledge of AWS security services: Security Hub, GuardDuty, CloudTrail, Config, IAM, Macie, Inspector, VPC security architecture, and SCPs.
• Experience conducting OT/ICS cybersecurity assessments in manufacturing, industrial, or critical infrastructure environments is strongly preferred.
• Familiarity with threat modeling frameworks (MITRE ATT&CK, STRIDE) and their application to cloud and OT environments.
• Experience developing security automation using SOAR platforms (Palo Alto XSOAR, Splunk SOAR, Tines, or equivalent) and scripting (Python, PowerShell).
• CISSP or CISM, AWS Certification, CompTIA Security+, GIAC, GCIA, GCIH, Palo Alto PCNSE or Splunk Certified Architect, etc

Technical Skills:

• SIEM / Detection: Splunk ES, Microsoft Sentinel, Rapid 7, Palo Alto – rule authoring, data onboarding, correlation tuning
• AWS Security: Security Hub, GuardDuty, CloudTrail, Config, Macie, Inspector, WAF, IAM, SCPs, VPC security architecture, AWS Organizations
• Security Tools: Firewalls, IDS/IPS, SIEM (Rapid7/Splunk/Palo Alto), NAC (Cisco ISE/Aruba ClearPass), Vulnerability Scanners
• Cloud IAM: AWS IAM, Okta, Azure AD/Entra ID, PAM (CyberArk/BeyondTrust) – identity governance and least privilege
• OT/ICS Security: Dragos, Claroty, or Nozomi – OT visibility; Purdue model, IEC 62443, NERC CIP awareness

Atomic Machines is an equal opportunity employer that values diversity and does not discriminate based on characteristics protected by applicable law. We are committed to an inclusive interview experience, including for individuals with disabilities. To request an accommodation, contact [email protected]. To help our recruiting team manage application volume and respond to candidates more efficiently, Atomic Machines may use AI-assisted tools.