Security Operations Engineer

The Security Operations Engineer serves to strengthen and advance the security, privacy, and operational resilience of our enterprise technology environment. This role serves as a key contributor in protecting CRB's infrastructure, endpoints, identities, SaaS platforms, cloud services, and business application

The position combines expertise in cybersecurity, security engineering, IT operations, compliance, and offensive security to design, implement, and continuously improve controls that reduce organizational risk while supporting business productivity. This position partners closely with IT, Legal, Compliance, Privacy, and business stakeholders to translate security and regulatory requirements into practical technical solutions, sustainable operational processes, and measurable outcomes.

This position reports to the Director of Security Engineering.

Work Mode: Hybrid schedule. In office three days per week. 

Can be located in: Kansas City, MO, St. Louis, MO, Denver, CO, or Dallas, TX, 

Responsibilities

Security Engineering & Operations

• Serve as CRB's primary technical liaison to Managed Security Services Providers (MSSPs), overseeing security operations activities, vulnerability assessments, remediation efforts, and third-party service delivery.

• Maintain and administer the enterprise security and privacy risk register, ensuring risks are identified, assessed, tracked, mitigated, and reported in accordance with established governance processes.

• Develop, maintain, and enhance security policies, standards, procedures, control documentation, runbooks, user guidance, and incident response documentation in partnership with Security, Compliance, and Technology leadership

• Lead audit readiness and compliance activities by coordinating evidence collection, validating control effectiveness, supporting assessments, and maintaining comprehensive audit documentation, including access records, change records, vulnerability findings, incident documentation, and remediation evidence

• Implement, administer, and continuously improve security controls across cloud environments, SaaS platforms, and enterprise systems.

• Own identity and access management processes, including Azure Entra ID, single sign-on (SSO), multifactor authentication (MFA), privileged access management, provisioning, and deprovisioning activities.

• Support endpoint security, patch management, device compliance, configuration management, and asset lifecycle operations.

• Maintain accurate inventories of technology assets, applications, user accounts, licenses, data flows, and system ownership.

• Partner with IT teams and business stakeholders to improve secure configuration management, vulnerability remediation, backup and recovery capabilities, and operational resilience.

• Evaluate new technologies, vendors, integrations, and data management practices to ensure alignment with security and privacy requirements.

• Automate security and operational workflows using tools such as Python, PowerShell, Power Automate, Jira Automation, or comparable technologies.

• Support security monitoring, incident investigation, containment, response, recovery, and continuous improvement activities.

Security Testing & Risk Assessment

• Conduct authorized vulnerability assessments and penetration testing activities across infrastructure, networks, cloud environments, identity platforms, and enterprise applications.

• Perform attack-path analysis and red-team exercises to identify security weaknesses, privilege escalation risks, and control gaps.

• Analyze security events, threat intelligence, forensic evidence, and vulnerability findings to assess risk and business impact.

• Document findings, establish risk ratings, identify root causes, and recommend practical remediation strategies.

• Validate remediation activities through testing, evidence review, and control verification.

• Support tabletop exercises, incident response simulations, and security control testing programs.

• Ensure all testing activities are appropriately authorized, documented, and executed in accordance with organizational policies and business requirements.

Security, Privacy & Compliance

• Support compliance with applicable privacy and security regulations, including GDPR, Germany's Federal Data Protection Act (BDSG), and Switzerland's Federal Act on Data Protection (FADP).

• Promote Secure by Design and Privacy by Design principles throughout technology initiatives and operational processes.

• Support data governance activities including records of processing, data flow mapping, retention controls, access reviews, and protection of sensitive information.

• Partner with Legal, Privacy, Compliance, and business leaders on regulatory inquiries, vendor reviews, risk assessments, and remediation activities.

• Translate regulatory, audit, contractual, and customer requirements into actionable technical and operational controls.

• Assess third-party technology providers and document associated security and privacy risks.

• Track security and compliance findings through closure and provide meaningful reporting to technical and business stakeholders.

• Support CRB's security, privacy, and governance frameworks, including ISO and NIST-aligned initiatives.