Hybrid Security Engineer: CIS Benchmarks & Cloud

KeyBank; Brooklyn (OH); Hybrid; USD 96,000 - 181,000; Full time

Benefits offered by this job

Hybrid work model

In-office with flexible options

Job summary

KeyBank is seeking a Senior Exposure Management Engineer to design, implement and maintain secure configurations across on‑prem, cloud and hybrid environments, aligning with CIS Benchmarks and internal baselines. The role emphasizes continuous assessment, vulnerability management and audit readiness with Tenable and other industry tools.

Based in Brooklyn, Ohio, it requires travel flexibility and collaboration with security, infrastructure and development teams.

Qualifications

• Bachelor's degree in computer science, Cybersecurity, or related field or equivalent experience.
• 8+ years of experience in security engineering, configuration management, or related roles.
• Proficiency with configuration management tools (e.g., Ansible, Chef, Puppet) and scripting languages (PowerShell, Python, Bash).
• Experience with Vulnerability Management platforms (Tenable, Qualys, Rapid7 etc) running vulnerability scans, monitoring agent health, and maintaining scanner operability.
• Comprehensive expertise in Tenable or comparable vendor solutions for compliance scanning.
• Strong understanding of Cisco, Windows, Linux, Kali Linux, and macOS operating systems.
• Hands-on experience with cloud platforms (Google Cloud, Microsoft Azure, AWS).
• Familiarity with security frameworks and standards (e.g., CIS Benchmarks, SCAP, NIST CSF, MITRE ATT&CK).
• Experience with ServiceNow security related modules such as Vulnerability Response & Configuration Compliance
• Effective research, documentation, and reporting skills.
• Willingness to travel.

Responsibilities

• Configuration Management: Develop, implement, and maintain secure configuration baselines for operating systems, cloud platforms, applications, and network devices, ensuring strict adherence to CIS Benchmarks and organizational standards.
• Continuous Assessment: Conduct regular configuration assessments and audits using Tenable and other industry-standard tools to validate compliance with CIS Benchmarks, NIST, PCI-DSS, and other regulatory requirements.
• Vulnerability Management: Perform authenticated and unauthenticated vulnerability scans with Tenable, analyze results, and coordinate remediation activities.
• Threat Intelligence: Collaborate with the Cyber Threat Intelligence and Red Team to incorporate threat intelligence into configuration management and prioritization processes.
• Project Collaboration: Work with project teams, architects, and third-party vendors to embed security controls in system designs and deployments and validate configuration requirements.
• Cross-Team Collaboration: Partner with infrastructure, application, and security teams to ensure baseline requirements are understood, implemented, and maintained across all environments.
• Compliance Reporting: Track and report on configuration compliance metrics, maintain automated dashboards, and provide visibility to stakeholders and leadership within the ServiceNow application.
• Documentation & Audit Support: Document configuration changes, exceptions, and remediation activities. Support internal and external audits by providing evidence of compliance and remediation.
• Process Automation: Assist in the development and automation of configuration management and compliance reporting tools and frameworks.
• Knowledge Sharing: Share knowledge and best practices with the team through presentations, documentation, and training sessions.
• Incident Response: Support incident response and remediation efforts by identifying and correcting misconfigurations and partnering with blue teams to improve detection and response capabilities related to configuration changes and vulnerabilities.

Skills

Security engineering

Configuration management

Vulnerability scanning

Documentation

Willingness to travel

Education

Bachelor's degree in computer science or related field

Tools

Ansible

Chef

Puppet

PowerShell

Python

Bash

Tenable

Qualys

Rapid7

CIS Benchmarks

SCAP

NIST CSF

MITRE ATT&CK

ServiceNow Vulnerability Response

ServiceNow Configuration Compliance

Job description

KeyBank is seeking a Senior Exposure Management Engineer to design, implement and maintain secure configurations across on‑prem, cloud and hybrid environments, aligning with CIS Benchmarks and internal baselines. The role emphasizes continuous assessment, vulnerability management and audit readiness with Tenable and other industry tools.

Based in Brooklyn, Ohio, it requires travel flexibility and collaboration with security, infrastructure and development teams.