Incident Response Lead

DeWinter Group; Chelmsford (MA); On-site; USD 130,000 - 180,000; Full time

Job summary

DeWinter Group is seeking a Senior Security Operations Engineer to protect the education data of millions of K-12 students and teachers. This onsite role in Chelmsford, MA involves hands-on security operations, threat monitoring, and incident response in a cloud-native environment.

You will partner with cloud, DevOps, and software teams to weave security into development, implement automated detection, and maintain runbooks and SOPs while aligning with FERPA/COPPA requirements.

Qualifications

• 5+ years in Cybersecurity Operations, Security Engineering, or modern Cloud-Native SOC.
• Experience securing AWS environments (IAM, CloudTrail, GuardDuty, VPC).
• Hands-on with SAST/DAST/SSo tools like Checkmarx, Snyk, Veracode, and IAM platforms.

Responsibilities

• Monitor security alerts across AWS, containers, endpoints, and SaaS systems.
• Lead incident triage, investigation, and remediation with MDR partner ReliaQuest.

Skills

Security monitoring

Incident response

DevSecOps

Automation scripting

IAM & SSO

Cloud security

Tools

Checkmarx

Snyk

Veracode

Ping Identity

Okta

Rubrik

ReliaQuest MDR

Job description

This role is with a DeWinter Educational Technology Partner

Onsite a few days per week or as needed in Chelmsford, MA

12 Month + contract (or contract to hire, if desired)

As a Senior Security Operations Engineer, you will be a key individual contributor responsible for executing and continuously improving our core cybersecurity operations. You will play a vital role in protecting the educational data of millions of K-12 students and teachers.

This role blends hands‑on engineering, automated detection, threat monitoring, and incident response. You will partner closely with our cloud infrastructure, DevOps, and software engineering teams to ensure security is seamlessly integrated into our daily operations.

Key Responsibilities

• Security Monitoring & Incident Response: Perform hands‑on monitoring, triage, and investigation of security alerts across AWS cloud environments, containerized applications, endpoints, and SaaS systems. Coordinate with our Managed Detection and Response (MDR) partner (ReliaQuest) to remediate escalated threats.
• DevSecOps & Automation: Collaborate with product engineering to integrate security practices early in the development pipeline. Build and maintain automated response workflows and detection scripts to reduce manual workload and alert fatigue.
• Vulnerability & Application Security Management: Administer and optimize our vulnerability scanning and Static Application Security Testing (SAST) tools (such as Checkmarx). Partner with software developers to validate, prioritize, and track the remediation of identified flaws.
• Identity & Access Operations: Support Identity & Access Management (IAM) platforms (such as Ping Identity), ensuring robust, secure single sign‑on (SSO) and federated access configurations for school districts and internal systems.
• Data Protection & Compliance: Monitor and configure Data Loss Prevention (DLP) controls to safeguard student and teacher data. Ensure operational alignment with student privacy frameworks, including FERPA and COPPA.
• Disaster Recovery Support: Support continuous posture testing, cloud backups, and ransomware containment strategies utilizing security recovery tools (such as Rubrik).
• Continuous Improvement: Develop and maintain incident response runbooks, Standard Operating Procedures (SOPs), and security engineering documentation.

Senior Security Operations Engineer

• Experience: 5+ years of hands‑on experience in Cybersecurity Operations, Security Engineering, or a modern Cloud‑Native SOC environment.
• Cloud Infrastructure: Deep operational experience securing Amazon Web Services (AWS) environments (IAM, CloudTrail, GuardDuty, VPC Security Groups).
• Application Security Tools: Hands‑on experience with SAST, DAST, or Software Composition Analysis (SCA) tools (e.g., Checkmarx, Snyk, Veracode).
• Automation/Scripting: Proficiency in scripting languages (such as Python, PowerShell, or Bash) to automate daily security tasks and integrations.
• Identity Management: Familiarity with enterprise IAM and SSO solutions (e.g., Ping Identity, Okta) and authentication protocols (SAML, OIDC, OAuth).
• Communication: Excellent collaboration skills with the ability to translate complex security risks into actionable instructions for software development and IT teams.

Preferred Qualifications

• Relevant certifications: CISSP, AWS Certified Security Specialty, or GIAC (GCIH, GCIA, GCDA).
• Prior experience in the EdTech space or an environment governed by strict data privacy compliance (FERPA, COPPA, HIPAA, or SOC2).
• Familiarity with Infrastructure as Code (IaC) security tools (e.g., Terraform scanning).