Cybersecurity Engineer

Sunwest Bank; Draper (UT); On-site; USD 100,000 - 180,000; Full time

Job summary

Sunwest Bank is seeking a Cybersecurity Engineer to strengthen cyber resilience in a regulated financial environment. You will investigate high-severity alerts and own the tools that detect, prevent, and respond to threats across endpoints, identity, cloud, and networks.

You will partner with IT, infrastructure, cloud, development, data, and business teams to design and tune detections, support audits, and improve security operations.

Qualifications

• Demonstrated ability to independently investigate, scope, contain, and coordinate response to complex cybersecurity events using SIEM/EDR/XDR or related tools.
• Hands-on experience configuring, tuning, or improving cybersecurity platforms in large enterprises.
• Strong understanding of endpoint, identity, network, cloud, and data protection security.
• Experience creating or improving detections, alerts, dashboards, and automation to improve security operations.
• Familiarity with NIST CSF, MITRE ATT&CK, CIS, and control validation methods.

Responsibilities

• Lead investigation and response for high-severity cybersecurity alerts and incidents across endpoints, identity, cloud, and networks.
• Own and improve cybersecurity platforms, including configuration, tuning, integrations, alert logic, and dashboards.
• Design and validate technical controls to improve prevention, detection, response, and audit readiness.
• Develop threat-informed detections, playbooks, and hunting methods aligned with MITRE ATT&CK and NIST CSF.
• Translate incident lessons learned into practical engineering improvements and risk reductions.
• Collaborate with IT, infrastructure, cloud, development, AI, data, and business teams to embed security controls.
• Support audits, risk assessments, and third-party reviews with technical security evidence.
• Mentor and assist analysts to mature security operations practices.

Skills

SIEM

EDR/XDR

Cloud security

Endpoint security

Identity security

Education

Bachelor's degree in Cybersecurity

Tools

Microsoft Defender XDR

Microsoft Sentinel

Purview

Intune

Proofpoint

Tenable

Snyk

Azure security capabilities

Job description

Job Title: Cybersecurity Engineer
Department: Information Security - 84
Reports to: Chief Information Security Officer (CISO) –

About the Role

This role is critical to strengthening cyber resilience in a highly regulated financial environment by combining senior-level security analysis, incident response, and technical ownership of cybersecurity platforms. As a Cybersecurity Engineer, you will investigate high-severity alerts and escalated security events while also designing, configuring, tuning, and improving the tools and controls used to detect, prevent, and respond to threats. You will partner across IT, infrastructure, cloud, identity, development, AI, data, and business teams to reduce cyber risk, improve control effectiveness, and support secure operations across the enterprise.

Schedule: Monday – Friday, Work hours may vary based on operational needs and may include early mornings or extended hours as required.
Work Location: Onsite
Travel: Occasional (up to 10%)

What You’ll Do

• Lead investigation and response for high-severity cybersecurity alerts, escalated analyst cases, suspicious activity, and confirmed or suspected security incidents across endpoint, identity, email, network, cloud, and application environments.
• Own and continuously improve cybersecurity platforms, including configuration, tuning, integrations, alert logic, detection coverage, dashboards, reporting, automation, and operational workflows.
• Design, implement, and validate technical security controls across enterprise systems to improve prevention, detection, response, recovery, and audit readiness.
• Build and refine threat-informed detections, response playbooks, hunting methods, and control improvements using frameworks such as MITRE ATT&CK, NIST CSF 2.0, and other applicable security and regulatory expectations.
• Translate threat intelligence, vulnerability findings, incident lessons learned, and control gaps into practical engineering improvements that reduce risk and improve security operations effectiveness.
• Partner cross-functionally with IT, infrastructure, cloud, identity, development, AI, data, and business teams to embed effective security controls into systems, applications, platforms, and processes.
• Support audits, examinations, risk assessments, control validation, third-party risk reviews, and remediation activities by providing technical security expertise and evidence.
• Mentor Cybersecurity Analysts, provide escalation support, improve analyst workflows, and help build mature, repeatable security operations practices.

What We’re Looking For

Required

• Demonstrated ability to independently investigate, scope, contain, and coordinate response to complex cybersecurity events and incidents using SIEM, EDR/XDR, NDR, email security, identity, cloud, data governance, or similar technologies.
• Hands-on experience administering, configuring, tuning, or improving cybersecurity tools and platforms in an enterprise environment.
• Strong technical understanding of endpoint security, identity and access management, network security, email security, cloud security, logging, vulnerability management, and data protection.
• Experience creating or improving detections, alerts, dashboards, response playbooks, security workflows, or automation to improve security operations effectiveness.
• Working knowledge of cybersecurity frameworks and threat-informed defense concepts, including NIST CSF, MITRE ATT&CK, CIS, and control validation methods.
• Ability to translate technical security issues into clear risk-based recommendations for technical teams, business stakeholders, and leadership.
• Ability to operate in a small-team environment where the role includes senior analyst responsibilities, platform ownership, escalation support, and hands-on execution.

Nice to Have

• 5+ years of experience in cybersecurity, information security, security engineering, IT security operations, or related technical security roles.
• Experience with Microsoft Defender XDR, Microsoft Sentinel, Purview, Intune, Proofpoint, Tenable, Snyk, Azure security capabilities, or similar security platforms.
• Experience with scripting, automation, SOAR, API integrations, PowerShell, Python, KQL, or other methods used to improve detection, response, reporting, or security operations efficiency.
• Experience working in financial services or another regulated industry, including familiarity with FFIEC, GLBA, PCI DSS, HIPAA, or similar requirements.
• Experience supporting vulnerability management, secure configuration baselines, cloud security, application security, AI governance, or secure software development practices.
• Relevant certifications such as CompTIA Security+, CySA+, Microsoft Security certifications, GIAC, CISSP, CRISC, or equivalent practical experience.
• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field, or equivalent practical experience.

Why You’ll Love Working Here

• Collaborative, mission-driven team focused on protecting customers, employees, and the Bank from evolving cyber threats.
• Opportunity to make a direct impact by both operating and improving the security program in a growing, highly regulated financial institution.
• Hands-on exposure to modern security tools, cloud security, AI governance, security operations, incident response, and enterprise risk reduction.

Physical Demands:

In general, the following physical demands are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to allow differently abled individuals to perform the essential functions of the job.

(Check the box that applies by double clicking on the box.)

Sedentary: Limited activity, no lifting, limited walking

Moderate: Mostly standing, walking, bending, frequent lifting

Light: Office work, some lifting, bending, stooping or kneeling, walking

The Fine Print

This job description reflects the general nature of the role and may change as business needs evolve. We are an equal opportunity employer. Sunwest Bank works with staff members and customers without regard to race, ancestry, national origin, sex, marital status, age, religion, medical condition, handicap, disability or veteran status and to assist the Bank in maintaining its affirmative action program.

Compliance with Bank Secrecy Act laws and regulations is considered an extremely serious matter, and it is intended that Sunwest Bank, through the purposeful efforts of its employees and officers, are expected to make every resolute attempt to conform to its Bank Secrecy Act Program and procedures. Failure to comply will be reflected in their performance review as well as in any bonus compensation programs in which they may participate.

Attend and complete all required classroom, computer-based, web-based and seminar training. It is the individual responsibility of every employee to maintain a current awareness and understanding of and to fully comply with Sunwest Bank’s “Code of Ethics and Conduct.” Each employee is also expected to maintain an awareness of the laws, regulations, internal policies and procedures that are appropriate for his/her position.

Note: The preceding job description has been designed to indicate the general nature and level and work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities, and qualifications required of employees assigned to this job. All job descriptions can be amended without notice as warranted by business necessity.

Federal Deposit Insurance Act This position is subject to Section 19 of the Federal Deposit Insurance Act. As such, an employment offer for this position is contingent on Sunwest Bank’s review of criminal conviction history, including pretrial diversions or program entries.