Senior Cybersecurity Engineer

Buchalter; Los Angeles (CA); On-site; USD 140,000 - 190,000; Full time

Job summary

Buchalter seeks a Senior Cybersecurity Engineer to lead architectural design and implementation of enterprise security controls. You will translate risk, privacy, and client requirements into secure, scalable security solutions and coach teams across functions.

The role acts as the highest technical escalation point within Cybersecurity Operations, driving incident response, vulnerability remediation, and continuous improvement while coordinating with Legal, Risk, Privacy, and Records teams.

Qualifications

• Bachelor's degree in cybersecurity, IT, CS, engineering, or equivalent.
• 5+ years of hands-on security engineering, architecture, or related roles.
• Experience designing and supporting enterprise cybersecurity technologies in hybrid environments.
• Experience leading complex technical implementations and cross-team coordination.
• Experience as a senior escalation resource for incidents, vulnerabilities, or outages.

Responsibilities

• Own design, deployment, and lifecycle of assigned security technologies.
• Translate requirements into secure architectures and plans.
• Lead proofs of concept, testing, and post-implementation validation.
• Develop runbooks, incident playbooks, and recovery procedures.
• Mentor cybersecurity personnel and coordinate with stakeholders.
• Escalate material risks through proper governance channels.

Skills

PowerShell

Python

APIs

Education

Bachelor's degree in Cybersecurity/IT/CS/Engineering

Tools

SIEM/MDR platforms

Job description

The Senior Cybersecurity Engineer serves as the lead technical resource within Cybersecurity Operations and is responsible for the architecture, engineering, implementation, administration, operational health, and continuous improvement of the Firm's cybersecurity infrastructure and technical security controls. Reporting to the Cybersecurity Operations Manager, the position translates cybersecurity strategy, risk, privacy, information-governance, client, and operational requirements into secure, supportable, resilient, and measurable technology solutions.

The role leads security technologies and material platform enhancements through requirements definition, architecture review, proof of concept, testing, deployment, operational acceptance, documentation, monitoring, and lifecycle improvement. The position partners with Network Operations, Applications and Development, Service Desk, Legal, Risk, Privacy, Information Governance, Records, vendors, and other stakeholders to integrate security into enterprise technology initiatives and protect Firm and client information.

The Senior Cybersecurity Engineer is the highest technical escalation point within Cybersecurity Operations and provides technical direction, mentorship, documentation, and knowledge transfer. The role owns assigned technical designs and implementation recommendations, but does not independently accept residual business risk, approve policy exceptions, establish cybersecurity strategy, or make final business-risk decisions. Unresolved material risks are escalated to the Cybersecurity Operations Manager and appropriate governance or risk owners.

ESSENTIAL FUNCTIONS AND RESPONSIBILITIES:

Security Architecture, Engineering, and Technology Implementation

• Own the technical design, implementation, integration, and lifecycle improvement of assigned cybersecurity technologies, major platform enhancements, and security controls.
• Translate business, risk, compliance, privacy, client, and operational requirements into secure architectures, implementation plans, engineering standards, and technical acceptance criteria.
• Lead proofs of concept, technical evaluations, configuration design, testing, deployment, operational acceptance, and post-implementation validation.
• Establish secure baselines, reusable implementation patterns, control mappings, and lifecycle standards for supported technologies.
• Evaluate emerging technologies and provide evidence-based recommendations regarding security value, integration risk, supportability, resilience, cost, and operational impact.
• Identify architecture dependencies, failure modes, capacity considerations, recovery requirements, technical debt, and compensating controls before production deployment.

Security Platform Ownership and Lifecycle Management

• Serve as the technical owner or designated lead engineer for assigned security platforms and associated integrations.
• Maintain platform health, supported versions, licensing awareness, configuration baselines, integration dependencies, service accounts, certificates, secrets, logging, monitoring, and recovery documentation.
• Develop technology roadmaps and lifecycle recommendations for upgrades, replacements, consolidation, and retirement of assigned platforms.
• Define operational health indicators, alerting requirements, support procedures, escalation paths, backup coverage, and vendor-support requirements.
• Validate that platform changes are documented, tested, approved, recoverable, and transitioned into steady-state operations.

Identity and Access Security

• Lead engineering efforts involving Microsoft Entra ID, Conditional Access, single sign-on, multifactor authentication, privileged access, workload identities, identity governance, and risk-based access controls.
• Design and maintain secure identity integrations, authentication patterns, authorization models, and administrative boundaries in partnership with technology teams.
• Review identity configurations and access pathways for least privilege, separation of duties, privileged-access controls, emergency access, lifecycle management, and Firm standards.
• Analyze delegated and application permissions, service principals, managed identities, access inheritance, token use, privilege escalation paths, and third-party access.
• Support periodic access-control validation and remediation of excessive, obsolete, or inappropriate privileges.

Network, Cloud, Endpoint, and Infrastructure Security

• Lead security engineering for firewalls, VPN technologies, segmentation, remote access, endpoint protection, email security, cloud-connected services, and related infrastructure controls.
• Partner with Network Operations and Applications and Development to securely configure and harden servers, endpoints, network devices, cloud services, enterprise applications, and supporting infrastructure.
• Review architecture, configuration, and connectivity changes for security impact, control effectiveness, data exposure, resilience, and alignment with approved standards.
• Design or validate controls for secure administration, segmentation, encryption, secrets management, certificate management, logging, and remote access.
• Identify opportunities to reduce attack surface, improve control coverage, simplify administration, and increase operational resilience.

Data Protection and Legal Services Security

• Engineer and validate safeguards for attorney-client privileged information, attorney work product, client confidential information, personnel information, and other sensitive Firm data.
• Support data classification, data loss prevention, encryption, secure transfer, retention, deletion, information barriers, ethical walls, and matter-centric access controls.
• Assess whether security technologies and integrations preserve client-specific security obligations, need-to-know access, records requirements, legal holds, and defensible retention where applicable.
• Partner with Legal, Privacy, Risk, Information Governance, Records, and application owners to translate applicable requirements into technical controls and evidence.
• Identify and elevate configurations or data flows that could result in unauthorized access, disclosure, commingling, transfer, or persistence of Firm or client information.

Cybersecurity Operations, Detection, and Incident Response

• Serve as the highest technical escalation point for advanced cybersecurity incidents, control failures, and complex operational issues.
• Lead or support technical investigation, evidence preservation, containment, eradication, recovery, root-cause analysis, and post-incident control improvement.
• Improve telemetry, detection logic, integrations, investigation workflows, and response capabilities across supported security platforms.
• Develop and maintain technical incident playbooks, containment procedures, emergency access methods, and recovery or rollback procedures.
• Coordinate with internal teams, service providers, and vendors during complex incidents and document technical decisions, actions, evidence, and lessons learned.
• Validate control restoration and monitoring effectiveness before affected services return to normal operation.

Technical Implementation, Change Control, and Operational Handoff

• Serve as technical lead for enterprise cybersecurity initiatives and coordinate engineers, analysts, vendors, and project participants through implementation.
• Develop implementation plans, test procedures, change records, rollback plans, deployment strategies, support requirements, risk controls, and success criteria.
• Ensure material changes receive appropriate architecture, security, change-management, and operational review before production deployment.
• Confirm that completed implementations include documentation, monitoring, ownership, support coverage, training, licensing, vendor escalation, and a defined transition into steady-state operations.
• Perform post-implementation validation and track unresolved findings, technical debt, exceptions, or follow-up actions to closure.

Vulnerability, Compliance, and Technical Risk Support

• Lead technical validation, prioritization, remediation planning, and closure verification for vulnerabilities and security-control gaps within assigned systems.
• Use exploitability, exposure, business criticality, control coverage, and available threat information to inform remediation recommendations.
• Support ISO 27001, audits, risk assessments, penetration testing, client-security requirements, evidence collection, and control validation through implementation and maintenance of technical controls.
• Provide technical input to third-party security evaluations and document required safeguards, configuration conditions, integration risks, and monitoring requirements.
• Support secure implementation of approved third-party solutions, including validation of configurations, integrations, identities, access controls, logging, data flows, incident-notification dependencies, and service continuity considerations.
• Document exceptions and residual technical risks requiring review or acceptance by designated risk owners.

Automation and Security Engineering Efficiency

• Develop and maintain scripts, workflows, integrations, and automation that improve control consistency, monitoring, evidence collection, configuration validation, and operational efficiency.
• Apply secure development, source-control, peer-review, testing, secrets-management, change-control, logging, and rollback practices to cybersecurity automation.
• Reduce repetitive manual work while ensuring automated actions are appropriately authorized, observable, supportable, and recoverable.
• Maintain documentation, ownership, operational support, and lifecycle controls for production cybersecurity automation.

Documentation, Knowledge Sharing, and Mentorship

• Develop and maintain architecture diagrams, engineering standards, secure baselines, implementation records, runbooks, support procedures, test results, decision records, and troubleshooting documentation.
• Provide technical direction, mentoring, peer review, cross-training, and knowledge transfer to cybersecurity personnel and partner teams.
• Reduce undocumented dependencies and single points of failure by ensuring current documentation, backup coverage, and shared operational knowledge for critical technologies.
• Communicate findings, technical risks, design decisions, remediation requirements, and implementation status clearly to technical and non-technical stakeholders.
• Promote disciplined engineering, ownership, accountability, and continuous improvement across Cybersecurity Operations.

Other Duties

• Perform other cybersecurity-related duties as assigned to support Firm operations and growth.

REQUIRED ENGINEERING DELIVERABLES:

• Security architectures, engineering designs, data-flow diagrams, and implementation plans.
• Secure configuration baselines, reference patterns, control mappings, and technical standards.
• Proof-of-concept findings, test plans, test results, deployment records, and post-implementation validation.
• Change, rollback, recovery, operational-acceptance, and support-transition documentation.
• Platform health requirements, monitoring specifications, incident playbooks, and troubleshooting runbooks.
• Vulnerability remediation plans, risk statements, exceptions, and closure evidence.
• Technology roadmaps, lifecycle recommendations, and technical debt records for assigned platforms.

KEY OUTCOMES:

• Assigned security platforms are secure, supportable, monitored, documented, resilient, and maintained through an intentional lifecycle.
• Material security and operational risks are identified, documented, remediated, or escalated before production deployment.
• Technical implementations meet documented requirements and include testing, rollback, monitoring, ownership, support, and operational handoff.
• Vulnerabilities and control gaps have risk-based priorities, clear owners, remediation plans, and validated closure evidence.
• Security incidents receive effective technical escalation, investigation, containment, recovery, and post-incident improvement.
• Reusable engineering standards and automation improve consistency, visibility, efficiency, and control effectiveness.
• Critical security technologies have current documentation, cross-training, and backup coverage that reduce single points of failure.
• Technical controls remain aligned with Firm cybersecurity, legal, privacy, information-governance, records, client, and operational requirements.

KNOWLEDGE, SKILLS, AND ABILITIES REQUIRED:

• Advanced understanding of information-security architecture, secure engineering, identity security, endpoint security, network security, cloud security, data protection, vulnerability management, and enterprise control design.
• Demonstrated ability to lead implementation and integration of enterprise cybersecurity technologies across hybrid on-premises and cloud-connected environments.
• Hands-on experience with identity and access security, endpoint protection, firewalls, remote access, segmentation, email security, SIEM or MDR integrations, vulnerability-management platforms, and data-protection technologies.
• Working knowledge of Microsoft Entra ID, hybrid identity, Microsoft security and compliance technologies, automation or scripting, APIs, service identities, secrets management, and infrastructure security.
• Ability to develop architectures, implementation plans, test procedures, secure baselines, technical standards, change and rollback plans, operational handoff materials, and lifecycle roadmaps.
• Understanding of ISO 2701, NIST guidance, secure-by-design principles, risk-based control selection, incident response, evidence requirements, and third-party security risk.
• Ability to analyze complex technical dependencies, failure modes, data flows, permissions, and control gaps and convert findings into practical recommendations.
• Strong troubleshooting, technical leadership, documentation, mentoring, stakeholder communication, prioritization, and project-coordination skills.
• Ability to communicate effectively with technical teams, attorneys, Firm leadership, Legal, Risk, Privacy, Information Governance, vendors, and business stakeholders.
• Ability to exercise independent technical judgment while escalating policy, exception, residual-risk, and business decisions through established channels.

Relevant Technology Environment

Relevant experience may include Microsoft Azure, Microsoft 365, Microsoft Entra ID, Microsoft Purview, Microsoft Defender, SIEM and MDR services, endpoint detection and response, vulnerability-management platforms, firewalls, VPN and secure-access technologies, email security, data loss prevention, privileged-access technologies, scripting and automation, source control, document-management systems, records-management systems, legal applications, and comparable enterprise technologies. Experience with every listed platform is not required.

SUPERVISORY RESPONSIBILITY:

Not applicable. The position provides technical direction, mentoring, peer review, and work coordination but does not have formal personnel-management responsibility.

INTERPERSONAL CONTACTS:

Has regular contact with others both inside and outside of the Firm. Common contacts include IT staff and managers, attorneys, administrative staff, Legal, Risk, Privacy, Information Governance, Records, business stakeholders, clients as appropriate, external service providers, and vendors. Contacts may involve confidential, privileged, proprietary, personal, or otherwise sensitive information.

WORKING CONDITIONS

• Normal office working conditions.
• Position is full-time, generally 40 or more hours per week.
• Scheduled or unscheduled work outside normal business hours may be required to support cybersecurity incidents, urgent remediation, production changes, maintenance activities, or critical Firm operations.
• Work may require occasional travel among the various offices.
• Regular exposure to computers.
• Physical ability to engage in repetitive motions of fingers and hands, to hear, and to see, with or without reasonable accommodation.

EDUCATION/EXPERIENCE:

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or an equivalent combination of education and relevant experience.
• Five or more years of progressive hands-on experience in security engineering, security architecture, security operations, infrastructure security, cloud security, identity security, or a closely related technical role.
• Demonstrated experience designing, implementing, integrating, and supporting enterprise cybersecurity technologies in hybrid on-premises and cloud-connected environments.
• Experience leading complex technical implementations and coordinating work across internal teams, service providers, vendors, and other third parties.
• Experience serving as a senior technical escalation resource for complex security incidents, control failures, vulnerabilities, or operational issues.
• Experience producing architecture documentation, implementation plans, test evidence, secure baselines, runbooks, operational handoff materials, and technical risk recommendations.
• Hands-on experience using PowerShell, Python, APIs, or comparable scripting and automation technologies.

Preferred Qualifications

• Seven or more years of progressive cybersecurity engineering or security architecture experience.
• Experience with Microsoft cloud, identity, security, compliance, endpoint, and data-protection technologies.
• Experience with firewalls, segmentation, secure remote access, SIEM or MDR integrations, vulnerability-management platforms, email security, and privileged-access technologies.
• Experience supporting ISO 27001, client-security reviews, audits, penetration tests, incident response, technical evidence collection, and control validation.
• Experience in a law firm, professional-services organization, financial institution, or another highly regulated environment.
• Experience mentoring engineers or analysts and establishing technical standards, platform roadmaps, or engineering practices.

Preferred Certifications

• CISSP, CCSP, SSCP, Microsoft AZ-500, Microsoft SC-100, or equivalent security, cloud, architecture, or vendor-specific certifications.
• GIAC, Microsoft, network-security, incident-response, identity-security, or secure-engineering certifications appropriate to assigned responsibilities.