Cybersecurity Engineer

Allegacy; Winston-Salem (NC); Presencial; USD 90.000 - 130.000; Jornada completa

Descripción de la vacante

Allegacy seeks a skilled Incident Response Analyst to protect member data and assets. You will monitor security tooling, triage alerts, and investigate suspicious activity across Windows/Linux logs, network data, and access events.

You will execute containment, eradication, and recovery actions with IT and application teams, document findings, and continually improve playbooks. The role involves collaboration with MDR providers and external partners to strengthen resilience.

Formación

• Strong problem solving and analytical skills; able to make quick decisions during incident response.
• Strong verbal and written communication; clearly convey security concepts to all business areas.
• Highly adaptable to a changing business and tech environment.
• Familiarity with financial services security standards (GLBA, NCUA, FFIEC, PCI DSS, SOX).
• Hands-on incident response experience (triage, containment, eradication, recovery).
• Ability to analyze security telemetry (Windows/Linux logs, firewall logs, DNS, proxy, auth logs).
• Experience with security monitoring and detection tools (SIEM dashboards, EDR).
• Knowledge of IAM concepts (MFA, privileged access) and investigation points for auth incidents.

Responsabilidades

• Monitor security tooling (SIEM, EDR, email/web security, firewall/VPN logs) and triage alerts.
• Investigate suspicious activity by analyzing logs and correlating events across systems.
• Execute incident response actions in partnership with IT and apps teams; isolate hosts and support remediation.
• Collect and preserve incident evidence and maintain chain-of-custody.
• Develop and improve incident response playbooks; participate in tabletop exercises.
• Tune detections and reduce false positives; work with tool owners on alert logic.
• Support vulnerability response by tracking remediation and coordinating patches.
• Coordinate with MDR provider, vendors, and law enforcement as directed.

Conocimientos

Incident response

Threat hunting

Log analysis

Forensics

Communication

Regulatory knowledge

Educación

Bachelor’s degree

Herramientas

SIEM

EDR

Descripción del empleo

Description

At Allegacy, our roots run deep — anchored in a longstanding commitment to doing right by our members and the communities we serve. Every role within our organization plays a vital part in nurturing the relationships that make that promise real. As a member of our team, you'll be empowered to live out our brand every day, building meaningful connections that support the financial wellbeing of those who count on us most.

Role Accountability

Our culture is built on teamwork, integrity, and a shared commitment to delivering a trusted member experience. In this role, you will support the Credit Union’s cybersecurity operations with a primary focus on incident response by monitoring for threats, triaging alerts, investigating suspicious activity, coordinating containment and remediation, and partnering with internal teams and our managed detection and response (MDR) provider to reduce risk and improve resilience.

Specific Accountabilities

• Monitor security tooling (e.g., SIEM, EDR, email/web security, firewall/VPN logs) and triage alerts to determine scope, severity, and required response actions.
• Investigate suspicious activity by analyzing logs and telemetry, correlating events across systems, and documenting findings in tickets and incident records.
• Execute incident response actions (containment, eradication, and recovery) in partnership with IT and application teams, including isolating hosts, blocking indicators, and supporting remediation.
• Collect and preserve incident evidence (logs, timelines, indicators) and support forensic activities as needed while maintaining chain-of-custody expectations.
• Develop, maintain, and improve incident response playbooks and procedures; participate in tabletop exercises and post-incident reviews to drive corrective actions.
• Tune detections and reduce false positives by partnering with tool owners; recommend improvements to alert logic, correlation rules, and response automation.
• Support vulnerability response by validating exposure, tracking remediation, and coordinating patching or mitigating controls for critical findings.
• Coordinate with internal teams and external partners (including our managed detection and response (MDR) provider, technology vendors, and law enforcement as directed) during investigations and response activities.
• Implement and validate security changes that support incident response outcomes (e.g., blocks, access adjustments, segmentation changes) and follow through on hardening items identified during investigations.
• Participate in an incident response on-call rotation (as required), provide timely escalation and status updates to stakeholders, and support incident communications aligned to severity and business impact.
• Leverage frameworks such as MITRE ATT&CK and perform light threat hunting (hypothesis-driven investigations) to proactively identify malicious activity and validate control effectiveness.
• Stay current on the threat landscape, attacker techniques, and incident response best practices; recommend process and control improvements based on lessons learned.

Requirements

Knowledge, Skills and Abilities

• Strong problem solving and analytical skills; must possess the ability to make quick decisions and use good judgment during incident response.
• Strong verbal and written communication skills; can clearly and confidently communicate information security concepts to all areas of the business.
• Highly adaptable to a constantly changing business and technology environment.
• Familiarity with regulatory and legal security standards and requirements relevant to financial services/credit unions such as GLBA, NCUA, FFIEC guidance, PCI DSS, and Sarbanes-Oxley (as applicable).
• Hands-on knowledge of incident response practices (triage, investigation, containment/eradication, recovery) and the ability to follow and improve playbooks and procedures.
• Ability to analyze security telemetry (Windows/Linux logs, firewall/VPN logs, DNS, proxy, authentication logs) to identify indicators of compromise and suspicious behavior.
• Experience with security monitoring and detection tools (e.g., SIEM queries/dashboards, endpoint detection and response) and familiarity with alert tuning and correlation concepts.
• Knowledge of Identity and Access Management concepts (MFA, privileged access management) and common investigation points for authentication-related incidents.
• Familiarity with data protection controls (e.g., DLP) and how to investigate and respond to potential data exposure events.
• Knowledge of risk management processes (e.g., methods for assessing and mitigating risk) and how incidents impact business risk.
• Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.
• Knowledge of cyber threats and vulnerabilities.
• Knowledge of specific operational impacts of cybersecurity lapses.
• Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
• Knowledge of network traffic analysis concepts (tools, methodologies, processes), including basic packet capture/analysis and web filtering technologies.
• Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.
• Working knowledge of networking fundamentals used in investigations (TCP/IP, DNS, HTTP/S, routing, VPN concepts) and common attacker techniques in enterprise environments.

Education and Experience

• Bachelor’s degree in Information Systems, Information Technology, Management Information Systems, Computer Science, Computer Engineering, or related field.
• 3-5 years of experience in information security, SOC operations, or incident response, including hands-on investigation and response to security events.
• Professional certifications preferred: Security+, CySA+, GCIH/GCIA (or similar), or CISSP/CCSP (a plus).