Remote Security Engineer

Belcan; United States; On-site; USD 172,000 - 207,000; Full time

Job summary

Belcan in the United States seeks an experienced security engineer to configure and optimize security across CrowdStrike, Zscaler, Palo Alto Networks firewalls, and Proofpoint within an enclave. You will implement endpoint detection, policy deployment, and response workflows while integrating with AD, Entra ID, Microsoft 365, and SIEM.

The role requires hands-on experience across data-center security, cloud identity, and threat prevention, plus ability to create migration plans and runbooks for

Qualifications

• Hands-on security engineering experience in enterprise, government, or other regulated environments.
• Demonstrated configuration and troubleshooting experience with CrowdStrike, Zscaler, Palo Alto Networks firewalls.
• Strong knowledge of endpoint protection, secure web access, network security, email security, threat prevention, logging, and incident‑response technologies.
• Experience integrating security platforms with identity, cloud, SIEM, ticketing, and enterprise infrastructure services.
• Working knowledge of TCP/IP, routing, DNS, TLS, certificates, proxies, APIs, authentication, email protocols, and security‑policy enforcement.
• Experience developing migration plans, test scripts, rollback procedures, and operational documentation.

Responsibilities

• Configure and optimize approved security capabilities across CrowdStrike, Zscaler, Palo Alto Networks firewalls, and Proofpoint.
• Implement endpoint detection and response policies, sensor deployment, endpoint groups, exclusions, prevention settings, alerting, and response workflows in CrowdStrike.
• Configure Zscaler web-security, access, traffic-forwarding, authentication, inspection, application-control, and policy-enforcement capabilities applicable to the enclave.
• Configure Palo Alto Networks firewall zones, interfaces, routing, security policies, NAT, application controls, URL filtering, threat-prevention profiles, logging, high availability, and approved remote-access capabilities.
• Configure Proofpoint email-security policies, anti-phishing protections, malware controls, sender authentication, quarantine workflows, mail routing, alerting, and reporting.
• Integrate security platforms with Active Directory, Entra ID, Microsoft 365, SIEM, IT service-management, vulnerability-management, PKI, DNS, and other approved enclave services.
• Implement least-privilege administrative access, role-based access control, multifactor authentication, service accounts, API integrations, certificates, and secure management interfaces.
• Configure centralized logging, alert forwarding, system-health monitoring, and incident-notification workflows.
• Support migration of approved policies, configurations, identities, agents, firewall rules, email-security settings, and other security capabilities into the enclave.
• Troubleshoot endpoint communication, traffic forwarding, authentication, certificate, firewall-policy, mail-flow, logging, and platform-integration issues.
• Conduct functional, security, failover, performance, and operational-readiness testing.
• Assess configurations against approved security requirements and identify implementation, integration, documentation, or evidence gaps.
• Collect assessment evidence, including configuration exports, screenshots, policy reports, access reviews, logs, test results, and remediation records.
• Develop configuration records, data-flow diagrams, test procedures, administrator runbooks, recovery procedures, and troubleshooting guides.
• Provide knowledge transfer and an orderly operational handoff before the engagement ends.

Skills

Security engineering

Incident response

Network security

Endpoint protection

Threat prevention

Tools

CrowdStrike

Zscaler

Palo Alto firewalls

Proofpoint

Job description

Job Duties:

• Configure and optimize approved security capabilities across CrowdStrike, Zscaler, Palo Alto Networks firewalls, and Proofpoint.
• Implement endpoint detection and response policies, sensor deployment, endpoint groups, exclusions, prevention settings, alerting, and response workflows in CrowdStrike.
• Configure Zscaler web-security, access, traffic-forwarding, authentication, inspection, application-control, and policy-enforcement capabilities applicable to the enclave.
• Configure Palo Alto Networks firewall zones, interfaces, routing, security policies, NAT, application controls, URL filtering, threat-prevention profiles, logging, high availability, and approved remote-access capabilities.
• Configure Proofpoint email-security policies, anti-phishing protections, malware controls, sender authentication, quarantine workflows, mail routing, alerting, and reporting.
• Integrate security platforms with Active Directory, Entra ID, Microsoft 365, SIEM, IT service-management, vulnerability-management, PKI, DNS, and other approved enclave services.
• Implement least-privilege administrative access, role-based access control, multifactor authentication, service accounts, API integrations, certificates, and secure management interfaces.
• Configure centralized logging, alert forwarding, system-health monitoring, and incident-notification workflows.
• Support migration of approved policies, configurations, identities, agents, firewall rules, email-security settings, and other security capabilities into the enclave.
• Troubleshoot endpoint communication, traffic forwarding, authentication, certificate, firewall-policy, mail-flow, logging, and platform-integration issues.
• Conduct functional, security, failover, performance, and operational-readiness testing.
• Assess configurations against approved security requirements and identify implementation, integration, documentation, or evidence gaps.
• Collect assessment evidence, including configuration exports, screenshots, policy reports, access reviews, logs, test results, and remediation records.
• Develop configuration records, data-flow diagrams, test procedures, administrator runbooks, recovery procedures, and troubleshooting guides.
• Provide knowledge transfer and an orderly operational handoff before the engagement ends.

Required Qualifications:

• Hands‑on security engineering experience in enterprise, government, or other regulated environments.
• Demonstrated configuration and troubleshooting experience with CrowdStrike, Zscaler, Palo Alto Networks firewalls.
• Strong knowledge of endpoint protection, secure web access, network security, email security, threat prevention, logging, and incident‑response technologies.
• Experience integrating security platforms with identity, cloud, SIEM, ticketing, and enterprise infrastructure services.
• Working knowledge of TCP/IP, routing, DNS, TLS, certificates, proxies, APIs, authentication, email protocols, and security‑policy enforcement.
• Experience developing migration plans, test scripts, rollback procedures, and operational documentation.

#Must demonstrate experience with at least 2 of the 3 security tools. At a minimum, experience of Crowdstrike or Zscaler is acceptable.

Preferred Qualifications & Skills:

• Experience supporting CUI enclaves, government cloud environments, or Department of Defense contractors.
• Familiarity with CMMC, NIST SP 800‑171, assessment evidence, and security‑control validation.
• Experience integrating the specified platforms with Microsoft 365 Government Community Cloud High, Azure Government, AWS GovCloud, or hybrid environments.
• Relevant CrowdStrike, Zscaler, Palo Alto Networks, Proofpoint, or cybersecurity certification.

Compensation:

We provide a competitive pay and benefits package. This position is offering an hourly rate of $125.00-150.00/hr, however, Belcan considers several factors when extending an offer, including but not limited to education, experience, geographic location, and discipline. Benefits offered may include health care, dental, vision, life insurance; 401(k); education assistance; paid time off including PTO, holidays, and any other paid leave required by law.

Belcan is an equal opportunity employer. Your application and candidacy will not be considered based on race, color, sex, religion, creed, sexual orientation, gender identity, national origin, disability, genetic information, pregnancy, veteran status or any other characteristic protected by federal, state or local laws.