Security Engineer

Sierra Central Credit Union; Don Mariano Marcos; On-site; PHP 7,371,007 - 8,906,633; Full time

Benefits offered by this job

Medical, Dental & Vision Insurance

401(k) Retirement Plan

Paid Time Off

Travel Expense Reimbursement

Telehealth Services

EAP

Job summary

Sierra Central Credit Union is seeking a ground-floor security engineering professional to design and operationalize a Microsoft 365 E5 security stack. You will own deployment, tuning, and roll-out of security controls across email, data loss prevention, and cloud collaboration tools.

You will lead phishing simulations, handle incident response with an MDR partner, and work with IT and business units to strengthen risk management and audit readiness.

Qualifications

• Minimum 4 years of hands-on security engineering experience in a Microsoft-centric enterprise.
• Deep working knowledge of Microsoft 365 E5 security and compliance capabilities and cloud file sharing technologies.
• Knowledge and experience with firewalls, VPNs, and network security practices.
• Demonstrated incident investigation experience: log analysis, endpoint and identity forensics, and post-incident documentation.
• Email security administration and phishing simulation program experience.
• Familiarity with risk management and audit practices in regulated environments.
• Strong written and verbal communication; able to explain risk to engineers and executives.
• Ability to work onsite at Yuba City headquarters.

Responsibilities

• Engineer, deploy, and tune the Microsoft 365 E5 security stack.
• Secure cloud file sharing across SharePoint Online, OneDrive, and Teams; design DLP labeling and governance.
• Administer and tune enterprise email security; anti-phishing controls and SPF/DKIM/DMARC posture.
• Own phishing simulation campaigns; design, execution, metrics, and remediation training.
• Lead incident investigation and response with MDR provider; triage and root-cause analysis.
• Support vulnerability management; analyze scans and coordinate remediation.
• Contribute to risk management, audits, and third-party risk reviews.
• Support privacy and data protection programs; GLBA alignment.
• Mentor junior security staff and act as security resource across the credit union.

Skills

Security engineering

Microsoft 365 E5 security

Incident investigation

Email security

Risk management

Communication

Onsite work

Tools

Microsoft Sentinel

Defender XDR

Entra ID

Intune

Purview

SharePoint Online

OneDrive

Teams governance

Job description

About the Opportunity

Sierra Central Credit Union is a member-owned financial institution that has served Northern California communities for more than 70 years. This is a ground-floor security engineering seat: you will help design and operationalize the architecture rather than inherit someone else's, and your work will directly shape how a regulated financial institution protects its members for the next decade.

You will report to the VP of Information and Cyber Security and work alongside an Information Security Specialist as part of the Information Systems and Information Technology (ISIT) department. We are a Microsoft shop, and this role sits at the center of operationalizing a Microsoft 365 E5 security stack that is licensed but not yet fully deployed. If you want to build rather than maintain, this is that job.

What You Will Do

• Engineer, deploy, and tune the Microsoft 365 E5 security stack: Microsoft Sentinel, Defender XDR, Entra ID, Intune, Microsoft Purview (DLP, sensitivity labels, information protection), and Defender for Cloud Apps.
• Secure cloud file sharing and collaboration across SharePoint Online, OneDrive, and Teams: tenant sharing policies, sensitivity labeling, DLP policy design in monitor and enforce modes, and OAuth application consent governance.
• Administer and tune enterprise email security: secure gateway policy, anti-phishing and impersonation controls, and SPF, DKIM, and DMARC posture.
• Own the phishing simulation and testing program end to end: campaign design, execution, click-rate and reporting metrics, and targeted remediation training.
• Lead incident investigation and response in partnership with our managed detection and response provider: triage, containment, root-cause analysis, and post-incident reporting aligned to NCUA cyber incident notification requirements.
• Support vulnerability management: scan result analysis, remediation coordination with infrastructure and systems teams, and penetration test scoping and remediation tracking.
• Contribute to risk management and audit readiness: control design and evidence, support for NCUA examinations and internal and external audits, and third-party risk reviews.
• Support the privacy and data protection program: data classification, insider risk monitoring, and GLBA Safeguards Rule alignment.
• Mentor junior security staff and act as a security resource for IT peers and business units across the credit union.

Requirements

What You Bring (Required)

• Minimum 4 years of hands-on security engineering experience, including significant time in a Microsoft-centric enterprise environment.
• Deep working knowledge of Microsoft 365 E5 security and compliance capabilities and cloud file sharing technologies (SharePoint Online, OneDrive, Teams governance, and DLP).
• Knowledge and experience with firewalls, VPNs, and network security practices and tools.
• Demonstrated incident investigation experience: log analysis, endpoint and identity forensics, and clear post-incident documentation.
• Email security administration and phishing simulation program experience.
• Working familiarity with risk management and audit practices in a regulated environment.
• Strong written and verbal communication, comfortable explaining technical risk to both engineers and executives.
• Ability to work onsite at our Yuba City headquarters.

What Sets You Apart (Preferred)

• Financial services or credit union experience; familiarity with NCUA and FFIEC regulatory expectations.
• Certifications such as CISSP, CISM, GIAC, or Microsoft SC-200, SC-100, or SC-400.
• SIEM engineering depth: KQL, analytics rule development, automation and SOAR workflows.
• EDR operations experience and coordination with MSSP or MDR partners.
• Privacy framework knowledge: GLBA, CCPA/CPRA.
• A track record of mentoring, training, or developing junior staff.

Physical Requirements and Work Environment

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential function of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

1. Prolonged periods of sitting at a desk and working on a computer – 7 to 8 hours per day.
2. Light lifting, carrying, pushing and/or pulling objects up to 25 lbs.
3. Intermittent walking, bending, twisting and stooping.
4. General office environment: works generally at a desk in a well-lighted, air-conditioned cubicle/office, with moderate noise levels.
5. Occasional exposure to raised floors, server noise, and limited hot/cold zones.

Work Location

This position is based at our Corporate Headquarters in Yuba City, CA.

Compensation Range

The company anticipates offering an annual salary range between $120,000 to $145,000 for this position at the time of hire. This range includes base salary (or hourly wages) and does not include possible overtime for non-exempt employees or any applicable performance-based incentives or commissions.

Annual Merit Increase

Employees are eligible for a discretionary yearly merit-based salary adjustment, based on individual performance and company results.

Comprehensive Benefits Package

We provide a robust benefits package designed to support your health, financial security, and work-life balance including:

• Medical, Dental & Vision Insurance options
• Voluntary Lines including hospital indemnity, accident, and critical illness policies
• Company Paid HRA (with enrollment in certain health plans)
• Company Paid Basic Term Life Insurance
  • Coverage at 2× annual base salary
• Company Paid Long-Term Disability Insurance for Full-Time Employees
• Company Paid Telehealth Services Membership (Teladoc)
• Company Paid Employee Assistance Program (EAP)
• 401(k) Retirement Plan
  • Employer-funded safe harbor contribution of 3% of employee's eligible earnings
  • Discretionary employer match on employee contributions
• Flexible Spending Accounts
  • HSA
  • Medical FSA
  • Dependent Care FSA
  • Limited Purpose FSA
• Paid Time Off
  • Vacation accruals based on status and tenure within company
  • 12 sick days accrued annually for full-time employees
  • 1 hour for every 30 hours worked for part-time employees
  • 11 paid holidays
• Travel Expense Reimbursement
  • All necessary and work-related travel expenses will be reimbursed in accordance with company policy

The preceding list of duties does not include all tasks and responsibilities that may be required with this position. Additional tasks may be assigned, as departmental and operational needs require.