Security Engineer, Technical Assurance in New York

Energy Jobline ZR; New York (NY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Energy Jobline ZR in New York, NY is seeking a Security Engineer for Technical Assurance on a hybrid, Manhattan-based team. You will validate vendor security, test deployments, and patch components to maintain a robust security stack.

You’ll review SOC 2 evidence, assess CVEs, tune DLP, and coordinate external pen tests with remediation. Expected: 7+ years of security experience and relevant certifications.

Qualifications

• 7+ years in security with hands-on practice.
• Ability to verify controls and vendor evidence beyond scanners.
• Experience with risk assessment and control remediation.
• Familiarity with NIST CSF, 800-53, CIS, MITRE ATT&CK.

Responsibilities

• Review vendor SOC 2 reports and validate claims with practical testing.
• Test product deployments and patch security gaps (e.g., proxy).
• Tune DLP to reduce false positives and avoid alert fatigue.
• Scope, supervise, and support external pen tests and remediation.

Skills

Hands-on security

Vendor assessment

Threat modeling

Security tooling

Education

CISSP

CISA

CRISC

SANS/GIAC certs

Tools

Splunk

CrowdStrike

Netskope

Qualys

Gurucul

Symantec ProxySG

Swimlane

BlinkOps

Job description

Job Description

Security Engineer, Technical Assurance

Manhattan, hybrid. NYC metro only.

If you’re the security engineer on a small team, you know what this job is before I describe it.

You’re the one who gets the Slack message asking if a tool is safe to buy. You read the vendor’s SOC 2, you spin the thing up and poke at it yourself, you then tell Legal what to push back on, and then you go patch the proxy because nobody else is going to. You do a little of everything because there’s nobody to hand it to.

That’s the role. The difference is the scale of what you’re protecting.

What the week looks like.

• HR wants a platform that will hold employee data. You pull the vendor’s SOC 2 and catch that the observation window is three months and the scope skips the system that would actually hold the data. Then you test the product yourself, because “we enforce MFA” is a claim until you’ve tried to get around it. You write it up in plain English and you’re in the room when they decide.
• A CVE that just dropped and figuring out whether it’s reachable here or just a scary number.
• Tune DLP so it stops firing on every spreadsheet.
• Scope an outside pen test and running the remediation after.

Roughly 40% risk and vendor reviews, 30% hands‑on validation, 20% keeping the security stack healthy, the rest investigations and reporting.

Can you test whether a control actually works, with your own hands, not by reading a scanner report. And can you tell what a piece of vendor evidence is really worth. Everything else is teachable and they’ll teach it.

The stack is Splunk, CrowdStrike, Netskope, Qualys, Gurucul, Symantec ProxySG, Swimlane, and BlinkOps. Nobody has all eight. Don’t screen yourself out over a platform.

7+ years in security with real keyboard time. NIST CSF, 800-53, CIS, MITRE ATT&CK. CISSP, CISA, CRISC, GSEC, GCIH, GPEN, or OSCP all count.