Security Engineer

Old Republic; United States; Remote; USD 110,000 - 160,000; Full time

Benefits offered by this job

Remote work

Job summary

Old Republic is seeking a technically strong Security Engineer reporting to the Business Information Security Officer. This remote role will drive security and compliance initiatives across the organization and its operating companies, aligning with enterprise policies and regulatory requirements.

You will assess applications, review architecture, identify risk, and help OpCos implement enterprise security solutions while collaborating with IT, development, and business leadership.

Qualifications

• Bachelor’s degree or equivalent practical experience.
• 6+ years in cybersecurity, security architecture, or related field.
• Experience assessing risks and advising stakeholders.
• Knowledge of OWASP Top 10, API security, and secure SDLC.
• Ability to translate risks into practical security requirements.

Responsibilities

• Participate in security design reviews, risk assessments, architecture reviews, and threat modeling.
• Assess new applications, SaaS/cloud services, and third parties to identify risks and controls.
• Act as a security advisor to OpCos and stakeholders.
• Translate policies and risk findings into practical security requirements and design recommendations.
• Support vulnerability remediation, audits, and security initiatives across OpCos.

Skills

Cybersecurity experience

Security architecture

Application security

Cloud security

Threat modeling

Vulnerability management

Data protection

Security operations concepts

Education

Bachelor’s degree in Information Security or related field

Tools

SAST

DAST

SCA

Cloud security tooling

Job description

Reports To: Business Information Security Officer

Department: Information Technology

Location/Schedule: Remote

Classification: Full-Time / Exempt

Who We Are:

Old Republic is a leading specialty insurer that operates diverse property & casualty and title insurance companies. Founded in 1923 and a member of the Fortune 500, we are a leader in underwriting and risk management services for business partners across the United States and Canada. Our specialized operating companies are experts in their fields, enabling us to provide tailored solutions that set us apart.

Position Overview:

Reporting to the Business Information Security Officer (BISO), the Security Engineer drives security and compliance initiatives across Operating Companies (OpCos). This role ensures alignment with enterprise policies, regulatory requirements, and industry standards while collaborating with technical and business teams. We are seeking a technically strong, business-facing Security Engineer to support the BISO by assessing applications and technology, reviewing architecture, identifying and prioritizing risk, and helping OpCos implement enterprise security solutions.

Essential Job Functions:

• Application & Project Security — 30%: Participate in application development and technology projects; perform security design reviews, application risk assessments, architecture reviews, and threat modeling. Understand APIs, authentication/authorization, cloud architectures, data flows, encryption, databases, and common web/application risks.
• Security Risk & Assurance — 25%: Assess new applications, major changes, SaaS/cloud services, third parties, and integrations; identify risks, document findings, determine appropriate controls, and work with stakeholders through remediation or risk acceptance.
• Security Consulting — 25%: Act as a security advisor to assigned OpCos, working with IT, application owners, infrastructure teams, project managers, developers, and business leadership. Help teams navigate enterprise security requirements.
• Security Requirements & Design — 10%: Translate enterprise security policies, standards, regulatory requirements, and identified risks into practical security requirements and design recommendations for applications, cloud services, integrations, and technology projects. Facilitate threat modeling and interpret results from SAST, DAST, SCA, vulnerability scanning, and cloud security tooling, rather than necessarily operating every tool.
• Security Program Support — 10%: Assist with vulnerability remediation, audit findings, exceptions, regulatory requirements, security initiatives, and escalations across the OpCos.
• Support incident response by acting as a liaison between enterprise and OpCo teams.
• Support customer security inquiries and remediation tracking.
• Prioritize security findings based on exploitability, exposure, asset criticality, data sensitivity, compensating controls, regulatory impact, and business impact.
• Help teams maintain security controls (e.g., anti-phishing, email filtering, DLP).
• Evaluate identity and access designs, including authentication, authorization, SSO/federation, privileged access, service identities, least privilege, and access patterns.
• Evaluate emerging technologies, including AI-enabled applications and services, for security, data protection, identity, integration, and third-party risks.
• Build trust and influence through collaboration rather than enforcement. Understand business objectives and operational constraints and balance security recommendations with business risk, usability, cost, and delivery requirements.
• Use security tools and platforms to help internal customers solve problems and work securely.
• Develop and communicate security metrics, risk trends, assessment findings, remediation status, and emerging concerns to technical teams and business stakeholders.

Qualifications:

• Bachelor’s degree in Information Security, Computer Science, Risk Management, or a related field. Equivalent practical experience will be considered.
• Six or more years of progressive experience in cybersecurity, security architecture, application security, cloud security, or technology risk, including experience assessing security risks and advising technical and business stakeholders.
• Demonstrated experience in application security, security architecture, or security engineering combined with security risk assessment and strong stakeholder skills.
• Demonstrated ability to work independently with general direction, exercise sound judgment, and elevate material risks or decisions appropriately.
• Comfortable with OWASP Top 10/API security, secure SDLC, threat modeling (eg., STRIDE), authentication and authorization, cloud/SaaS security, network/security architecture fundamentals, vulnerability management, encryption/data protection, and third-party integrations.
• Strong communication and collaboration skills, with the ability to engage technical and non-technical stakeholders.
• Experience partnering with cybersecurity, infrastructure, application development, cloud, identity, or IT operations teams.
• Demonstrated ability to translate technical security risks into practical recommendations for application owners, developers, infrastructure teams, and business leadership.
• Strong organizational skills and attention to detail.
• Strong working knowledge of identity and access management, network security, endpoint security, cloud security, application security, data protection, vulnerability management, and security operations concepts.
• Hands-on experience with enterprise cybersecurity technologies, security platforms, and cloud technology.
• Familiarity with scripting, APIs, automation, and data analysis to support assessments, reporting, validation, and workflow improvements.
• Relevant industry certifications such as CISSP, CCSP, CSSLP, CGRC, GIAC application/cloud security certifications, Microsoft AZ-500/SC-100/SC-300, or equivalent are preferred.

ORI is an Equal Opportunity Employer. ORI provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.