Senior IT Security Engineer

Simpro Group; Miami (FL); On-site; USD 120,000 - 180,000; Full time

Job summary

Simpro Group is seeking a Senior IT Security Engineer to own and advance security, risk management, and compliance across internal systems. This senior individual contributor role operates with autonomy and provides technical guidance on identity management, access controls, and resilience.

You will lead the security program, maintain risk registers, enforce governance and audit disciplines, oversee vendor risk, incident response playbooks, and drive remediation.

Qualifications

• Experience designing, implementing, and managing enterprise security programs and risk registers.
• Expertise in IAM, network and cloud security, and vulnerability management governance.
• Ability to evaluate third‑party vendor risk and govern data access security across complex environments.
• Incident response coordination, playbook development, and tabletop exercise experience.

Responsibilities

• Owns the enterprise security and compliance program, aligning with frameworks, certifications, and audit disciplines.
• Maintains organizational risk register across physical, logical, and systems infrastructure to guide remediation.
• Defines identity architecture standards and access controls to minimize exposure.
• Drives vulnerability governance with SLAs, metrics, and remediation oversight.
• Leads third‑party risk assessments before onboarding vendors and external tech.
• Oversees security questionnaire workflows and compliance reporting for external stakeholders.
• Shapes incident response playbooks and conducts tabletop simulations.

Skills

IAM

Network security

Cloud security

Vulnerability governance

Incident response

Playbook development

Tabletop exercises

Stakeholder management

Technical leadership

Risk assessment

Education

Bachelor's degree in Computer Science/Information Technology/Cybersecurity or equivalent

Job description

Job Context

The Senior IT Security Engineer is a senior individual contributor role responsible for owning and advancing the security, risk management, and compliance posture across internal systems and operational environments. This position defines security governance frameworks, oversees certification maintenance, and manages technical risk remediation across enterprise infrastructure. Operating with significant autonomy, the incumbent serves as an authoritative advisor on identity management, access controls, vulnerability governance, and vendor risk. Through technical authority and cross-functional influence, this role ensures internal operations maintain continuous alignment with industry security standards and organizational resilience objectives.

What You’ll Do

Owns the enterprise security and compliance program, driving continuous alignment with industry-standard security frameworks, certifications, and audit disciplines.

Establishes and maintains the organizational risk register across physical, logical, and systems infrastructure to prioritize risk mitigation and remediation strategies.

Defines and enforces identity architecture standards, access management controls, and credentials governance to minimize operational exposure.

Drives vulnerability management governance across technical environments by establishing severity SLAs, standardizing inspection metrics, and overseeing remediation adherence.

Leads third-party risk management initiatives by conducting security assessments of software vendors, integrations, and external technologies prior to onboarding.

Oversees security questionnaire workflows and compliance reporting to deliver streamlined assurance for external stakeholders.

Shapes incident response playbooks, conducts regular tabletop simulations, and acts as a primary technical advisor during security events and resilience reviews.

Advises technical and operational teams on secure configuration, access modeling, secrets management, and policy execution.

Evaluates emerging security platforms, governance technologies, and operational controls to continuously elevate enterprise resilience and audit readiness.

Balances security risk considerations against business velocity to recommend practical controls and defensible risk-acceptance thresholds.

This job description is not an exhaustive list of duties and may be modified at the discretion of Simpro Group

What You’ll Bring

• Demonstrated experience designing, implementing, and managing enterprise security programs, risk registers, and compliance audit lifecycles.
• Technical expertise in identity and access management (IAM), network security controls, cloud infrastructure security, and vulnerability management governance.
• Proven ability to evaluate third-party vendor risk and govern data access security across complex software environments.
• Practical experience in incident response coordination, playbook development, and conducting technical tabletop exercises.
• Exceptional communication and stakeholder management skills, with the ability to articulate technical risk and security trade-offs to non-technical partners.
• Demonstrated track record of setting technical direction, establishing standards, and influencing cross-functional technical teams without direct formal authority.
• Strong analytical, problem-solving, and decision-making capabilities focused on practical risk reduction and operational enablement.
• Relevant degree in Computer Science, Information Technology, Cybersecurity, or an equivalent combination of senior professional experience and industry certifications.

Our Core Values

• We Are One Team
• We Are Customer Centric
• We Are Growth Minded
• We Are Accountable
• We Celebrate Success

Simpro, AroFlo, BigChange & ClockShark are equal opportunity employers with a best-of-class onboarding program and supportive team environments. This means that we want everyone to feel welcome with us and to provide equal opportunities for everyone, regardless of age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex or sexual orientation, or any other non-performance factor.

*Please note, no agencies will be accepted in the recruitment of this role.