Security Engineer

The Phoenix Group; New York (NY); On-site; USD 120,000 - 165,000; Full time

Job summary

The Phoenix Group is seeking a Security Engineer to lead SOC 2 and ISO 27001 audits, develop and manage the firm’s compliance program using Vanta, Drata, or Secureframe, and craft policies aligned with NIST CSF, GDPR, and CCPA. You will build and maintain client Trust Centers, coordinate audit evidence, and guide vendors through risk assessments.

The role also covers EDR/MDM deployment and IAM hardening across cloud platforms, to support IPO readiness.

Qualifications

• 3–5+ years in information security or IT with 2+ years in compliance
• Experience leading a full audit using Vanta, Drata, or Secureframe
• Hands-on EDR and MDM administration
• Okta or Entra ID experience
• Google Workspace or Microsoft 365 security with cloud-platform exposure
• Vulnerability management and incident response experience
• Solid knowledge of SOC 2, ISO 27001, and NIST CSF; ability to draft audit-ready policies

Responsibilities

• Lead clients through SOC 2 and ISO 27001 audits, from readiness assessment and remediation through evidence collection and auditor coordination
• Manage the firm’s internal compliance program using Vanta
• Develop compliance roadmaps tied to client growth stages, fundraising, and IPO preparation
• Write and maintain security policies (incident response, access control, acceptable use, AI usage, BCDR, WISP) aligned with NIST, SEC Reg S-P, GDPR, and CCPA
• Build and maintain client Trust Centers and complete security questionnaires (SIG, CAIQ, RFPs)
• Assess new vendors and AI tools and advise clients on adoption
• Maintain vendor inventories, risk tiers, and attestations, and refine the TPRM process
• Deploy and manage EDR (SentinelOne) and MDM across Mac and Windows environments
• Strengthen identity and access controls with Okta, MFA, and 1Password
• Secure Google Workspace, Microsoft 365, and other SaaS and cloud platforms

Skills

Information security

Compliance experience

EDR administration

MDM administration

Okta / Entra ID

Cloud security

Vulnerability management

Incident response

SOC 2 / ISO 27001 / NIST CSF knowledge

Policy writing

Tools

Vanta

Drata

Secureframe

SentinelOne

Jamf

Mosyle

Intune

Okta

Entra ID

Google Workspace / Microsoft 365 security

Job description

Security Engineering

• Lead clients through SOC 2 and ISO 27001 audits, from readiness assessment and remediation through evidence collection and auditor coordination
• Manage the firm’s internal compliance program using Vanta
• Develop compliance roadmaps tied to client growth stages, fundraising, and IPO preparation
• Write and maintain security policies (incident response, access control, acceptable use, AI usage, BCDR, WISP) aligned with NIST, SEC Reg S-P, GDPR, and CCPA
• Build and maintain client Trust Centers and complete security questionnaires (SIG, CAIQ, RFPs)
• Assess new vendors and AI tools and advise clients on adoption
• Maintain vendor inventories, risk tiers, and attestations, and refine the TPRM process

Security Operations

• Deploy and manage EDR (SentinelOne) and MDM (Jamf, Mosyle, Intune) across Mac and Windows environments
• Strengthen identity and access controls with Okta, MFA, and 1Password
• Secure Google Workspace, Microsoft 365, and other SaaS and cloud platforms

Requirements

• 3 to 5+ years in information security or IT, including 2+ years of hands-on compliance work
• Experience taking a company through a full audit using Vanta, Drata, or Secureframe
• Hands-on EDR and MDM administration
• Okta or Entra ID experience
• Google Workspace or Microsoft 365 security, plus experience with a major cloud platform
• Vulnerability management and incident response experience
• Solid grasp of SOC 2, ISO 27001, and NIST CSF, with the ability to write audit-ready policies

Nice to Have

• Security+, CISSP, CISA, or ISO 27001 Lead Implementer
• MSP or consulting background
• SEC Reg S-P, SOX ITGC, or IPO readiness experience