Senior Security Engineer - 21994

Our client is a managed IT and cloud hosting provider built exclusively for tax and accounting firms in the United States. The company serves a large and growing base of accounting and bookkeeping firms across the country, with a strong record of reliability during tax season and fast, high-quality support.

The company operates two lines of business: a hosted cloud environment for accounting firms, and a managed security and compliance service for firms that need to meet industry regulations. As both the hosted environment and managed services grow, the company is hiring a Senior Security Engineer to own security end-to-end across both lines of business.

We are seeking a Senior Security Engineer to serve as the company's in-house Subject Matter Expert (SME) for security across its hosting and managed security services.

This individual will own defense, offensive testing, hardening, audits, and documentation from end to end. They will lead the security program and compliance readiness, manage detection and incident response, run vulnerability management and internal penetration testing, and define hardening standards for servers, networks, and Microsoft 365 environments. They will work closely with the Manager – IT, the infrastructure and identity SMEs, and the Support teams, and serve as the top escalation point for security issues in both lines of business.

This is a hands-on specialist role. The ideal candidate has 6–9 years of security experience, strong defensive and offensive skills, and the confidence to explain risk to leadership and clients. AI tools are part of the daily toolkit, and the Senior Security Engineer selects the right tools for security work and guides others in using them safely.

• Own the security program, including policies, standards, the risk register, and the security roadmap.
• Present security status and top risks to leadership.
• Own compliance readiness for SOC 2 Type II, IRS Publication 4557, the FTC Safeguards Rule, and the company's Written Information Security Plan (WISP), including evidence collection and audit support.
• Respond to client security questionnaires and audits.
• Review vendor security risk.
• Serve as the security escalation point for compliance clients.

• Own detection and response on CrowdStrike Falcon, including policy tuning, threat hunting, and log analysis in Falcon LogScale.
• Coordinate with managed detection and response (MDR) providers where they are used.
• Lead security incidents, including malware, ransomware, and business email compromise (BEC), from containment through recovery.
• Deliver Root Cause Analysis (RCA) reports for security incidents.
• Maintain the incident response plan and playbooks, and run tabletop exercises with the technical teams.

• Perform in-house vulnerability scans, internal penetration tests, Active Directory attack-path assessments, and phishing simulations.
• Prepare the scope for external penetration testing after internal audits are complete.
• Run the vulnerability management program, ranking findings by risk.
• Track remediation with system owners to agreed timelines.

• Define hardening baselines aligned with Center for Internet Security (CIS) benchmarks for servers, domain controllers, hypervisor hosts, the golden VM image, and Microsoft 365 tenants.
• Own Palo Alto firewall security policy, including rule reviews, client segmentation, and VPN security.
• Manage the per-client rollout of licensed threat prevention modules.
• Review privileged access, multi-factor authentication (MFA) coverage, and backup protection against ransomware with the identity and backup owners.

• Build security documentation and staff security awareness training.
• Act as the team's technical reference for security.
• Mentor engineers and support agents on secure practices and complex cases through shadowing, joint troubleshooting, and debriefs after cases are resolved.
• Guide the team in selecting and safely using AI tools for security work.

• 6–9 years of hands-on information security experience, including at least 4 years in security operations or incident response at a managed service provider (MSP), hosting provider, or regulated business.
• Strong defensive skills, including Endpoint Detection and Response (EDR), log analysis, threat hunting, and incident handling in Windows and Active Directory environments.
• Hands-on offensive skills, including vulnerability scanning, penetration testing methods, and Active Directory attack paths.
• Working knowledge of firewall policy and segmentation, CIS-based hardening, and Microsoft 365 security controls.
• Working knowledge of frameworks such as SOC 2 and the FTC Safeguards Rule.
• Demonstrated ability to explain risk to leadership and clients, write clear security documentation, and drive remediation across teams.
• Full professional fluency in written and spoken English, as the primary working language with U.S. clients.
• Ability to work independently with minimal day-to-day oversight and take responsibility for significant security risks.
• Availability to work a full night shift from the Noida office, covering U.S. business hours.

• Experience with CrowdStrike Falcon, Palo Alto Networks firewalls, Duo, Veeam, and Microsoft Defender for Office 365.
• Certifications such as OSCP, CISSP, or GIAC incident handling credentials.
• Experience in MSP, cloud hosting, or accounting and tax technology environments.
• Experience with IRS Publication 4557 or other financial-industry security requirements.
• Scripting in PowerShell or Python for security automation.
• Familiarity with AI tools such as Claude.

Candidates should be comfortable working with or quickly learning:

• CrowdStrike Falcon and Falcon LogScale
• Palo Alto Networks firewalls
• Microsoft 365 and Microsoft Defender for Office 365
• Active Directory and Windows Server
• Duo (MFA)
• Veeam (backup)
• Vulnerability scanning and penetration testing tools
• Phishing simulation tools
• PowerShell and Python
• AI tools such as Claude

• Full ownership of security as the company's in-house security expert.
• A senior, hands-on role spanning defense, offensive testing, compliance, and hardening.
• Direct visibility with leadership and clients.
• The chance to shape the security program of a growing managed IT and hosting provider.
• Daily use of modern security tools and AI-assisted workflows.

The ideal candidate is an experienced, hands-on security engineer who is comfortable owning security from end to end.

They can hunt for threats in CrowdStrike one day and run an internal penetration test the next. When an incident happens, they take charge, contain it, recover systems, and deliver a clear root cause analysis. They know how to harden servers, firewalls, and Microsoft 365 tenants, and they understand the compliance requirements that accounting firms face.

They explain risk clearly to leadership and clients, write documentation others can follow, and help engineers build secure habits. Most importantly, they work independently, take responsibility for significant risks, and keep the company and its clients protected.

Success in this role will be measured by:

• Mean time to detect and contain security incidents.
• Share of incidents closed with a completed RCA.
• Critical and high vulnerability findings fixed within agreed timelines.
• Reduction in open vulnerability findings over time.
• Share of systems meeting approved hardening baselines.
• Audit findings closed on time.
• Quality of security documentation and staff training.