Security Engineer

Watsco; Miami (FL); On-site; USD 110,000 - 150,000; Full time

Job summary

Watsco is seeking a Security Engineer to operate and continuously improve cybersecurity monitoring, incident response, vulnerability management, email and endpoint security, and cloud/identity controls. You will work with an MDR provider to reduce risk while ensuring independent review of security controls.

The role involves leading incident response, managing vulnerability programs, and coordinating with IT owners and vendors across the Americas. Local travel may be required.

Qualifications

• 4+ years in cybersecurity engineering or equivalent defensive-security experience.
• Hands-on knowledge of SIEM, EDR, email security, identity and cloud security.
• Ability to analyze logs and alerts, communicate risk clearly, preserve evidence, and coordinate remediation.
• Working knowledge of common security frameworks and controls, least privilege, segmentation, secure configuration, risk treatment.
• Willingness to participate in after-hours incident response and handle sensitive information with discretion.

Responsibilities

• Operate or oversee SIEM, EDR, email-security, identity, cloud, and MDR monitoring; investigate alerts and tune detections.
• Lead technical incident response with triage, containment, evidence preservation, and recovery support.
• Run the vulnerability-management program including scans, risk ranking, and remediation tracking.
• Manage Proofpoint policies, phishing investigations, and SPF/DKIM/DMARC coordination.
• Define and validate MFA, conditional access, and privileged access requirements with Infrastructure.
• Review firewall rules, cloud configurations, and network security for changes and risks.
• Maintain security policies, risk register, and audit evidence.

Skills

Incident response

Log analysis

Security operations

Risk communication

Remediation coordination

Tools

SIEM

EDR

Proofpoint

Microsoft Defender

Entra ID

Microsoft 365

Cloud security tools

Job description

Description

Watsco Inc. is the largest distributor of air conditioning, heating and refrigeration equipment and related parts and supplies in the HVAC/R distribution industry. We serve over 125,000 contractor-customers through our nearly 700 locations where more than 7,400 team members bring essential, sustainable comfort to families and businesses across the Americas. At Watsco, we recognize our responsibility to help drive the transition to a lower carbon future. That’s why we are committed to providing high efficiency, low carbon HVAC equipment and energy-saving parts and supplies to households and businesses across the Americas. Since January 2020, Watsco’s sales of high efficiency equipment has reduced future CO2e emissions by over 19.2 M MT. Learn more about our impact and how you can become part of this transformation at www.watsco.com/environment

Position Summary

Seeking a Security Engineer to operate and continuously improve cybersecurity monitoring, incident response, vulnerability management, email and endpoint security, cloud and identity controls, risk, and security assurance. This role partners with IT owners and an MDR provider to reduce risk while maintaining independent review of security controls.

Key Responsibilities

• Operate or oversee SIEM, EDR, email-security, identity, cloud, and MDR monitoring; investigate alerts, tune detections, validate logging coverage, and material events.
• Lead technical incident response, including triage, containment, evidence preservation, partner coordination, recovery support, post-incident review, and corrective-action tracking.
• Run the vulnerability-management program: maintain scan coverage, risk-rank findings, assign remediation, manage time-bound exceptions, rescan, and report overdue exposure.
• Administer Proofpoint security policy and investigate phishing; manage blocking, whitelisting, impersonation protection, SPF/DKIM/DMARC coordination, and security-related release escalations.
• Define and validate MFA, SSPR, Conditional Access, privileged access, account recovery, access review, and compromised-account requirements in partnership with Infrastructure.
• Define endpoint/server hardening, EDR, encryption, logging, and isolation requirements; validate remediation performed by Service Delivery and Infrastructure.
• Review segmentation, firewall rules, remote access, cloud configurations, internet-facing services, new applications, architectures, and significant technology changes.
• Maintain security policies, standards, risk register, exceptions, metrics, audit evidence, customer/security questionnaires, cyber-insurance support, and remediation plans.
• Assess critical vendors, partner access, SaaS/cloud services, contractual security requirements, and third-party remediation.
• Deliver role-based awareness, phishing exercises, incident runbooks, tabletops, and cross-training; coordinate MDR, forensic, penetration-testing, and specialist partners.

Qualifications

Required Qualifications

• 4+ years of cybersecurity engineering, security operations, incident response, vulnerability management, or equivalent defensive-security experience.
• Hands-on knowledge of SIEM, EDR, email security, identity and cloud security, vulnerability scanning, network security, Windows environments, and incident investigation.
• Ability to analyze logs and alerts, communicate risk clearly, preserve evidence, write policies/runbooks, and coordinate technical remediation across owners and vendors.
• Working knowledge of common security frameworks and controls, least privilege, segmentation, secure configuration, risk treatment, and audit evidence.
• Ability to participate in after-hours incident response and handle sensitive information with discretion.

Preferred Qualifications

• Experience with Microsoft Defender, Entra ID, Microsoft 365, Proofpoint, cloud security, MDR/SOC operations, scripting, and multi-site environments.
• Relevant Security+, CySA+, GCIH, GCIA, CISSP, CCSP, Microsoft Security, or comparable certification.
• Experience with NIST CSF, CIS Controls, ISO 27001, PCI DSS, privacy obligations, or customer assurance programs as applicable.

Working Conditions

This role may require scheduled after-hours work, participation in incident response, and local travel as stated above. Duties may evolve with business needs. Reasonable accommodations will be provided in accordance with applicable requirements.