IT Security Engineer (Cybersecurity)

Location: Fully remote, United States; up to 10% travel for company meetings, events, or other business needs.

Salary: $115,000–$125,000 plus bonus.

Company

hirify.global builds secure education technology tools, including single sign-on, usage analytics, and automated rostering, for students and educators worldwide.

What you will do

• Own and maintain internal security controls, control inventories, gap assessments, remediation tracking, and audit readiness for FedRAMP, ISO 27001, SOC 2 Type II, and GovRAMP.
• Evaluate vendors, SaaS platforms, AI services, browser extensions, integrations, and other technologies; maintain vendor risk records.
• Conduct access, privileged-account, device compliance, and SaaS permission reviews.
• Design, implement, document, configure, and monitor identity, access, logging, vulnerability management, encryption, EDR, SIEM, MFA, DLP, and related security controls.
• Monitor activity, investigate alerts, conduct threat hunting, coordinate incident response, manage vulnerabilities, and support endpoint, network, firewall, VPN, DNS filtering, and Zero Trust security requirements.
• Serve as the technical contact for auditors, automate security checks and evidence collection with PowerShell or Python, report security metrics and risks, and develop awareness programs and the internal security roadmap.

Requirements

• Hands-on experience owning security controls through a SOC 2 Type II audit or an equivalent FedRAMP, GovRAMP, or ISO 27001 audit, including IT-team controls, evidence, and direct auditor collaboration.
• At least 2 years of experience in a dedicated security role where security was the primary function.
• Experience conducting vendor and third-party security risk assessments before adoption.
• Hands-on experience with SIEM, EDR, security monitoring, incident response, and vulnerability management.
• Strong knowledge of endpoint, network, identity, access, and data security practices, including firewalls, VPN, DNS filtering, Zero Trust, MFA, encryption, and DLP.
• Working knowledge of Active Directory, SAML, OpenID Connect, and OAuth.
• Experience using PowerShell or Python to automate security checks and evidence collection.
• Familiarity with NIST, CIS Controls, SOC 2, and ISO 27001.
• Strong analytical, problem-solving, communication, and cross-functional collaboration skills; ability to resolve issues independently, prioritize competing audit, incident, and project work with little day-to-day direction, and balance daily responsibilities with longer-term initiatives.

Nice to have

• Working knowledge of NIST 800-53 controls and their mapping across the listed frameworks.
• Bachelor’s degree in information security, cybersecurity, or a related field; equivalent education and relevant experience are also considered.
• Experience securing Microsoft 365, Microsoft Entra ID, Google Workspace, enterprise SaaS applications, and employee endpoints.
• ISO 27001 Lead Implementer or Lead Auditor, CISSP, CISM, CISA, or CompTIA Security+ certification.

Culture & Benefits

• Four or more weeks of vacation, 13 paid holidays, and 12 weeks of fully paid parental leave for all parents.
• 401(k) with a 0.5:1 company match and medical, dental, and vision coverage.
• Company-paid life, short-term disability, and long-term disability insurance, with voluntary supplemental options.
• Paid volunteer days, tuition reimbursement, coaching, and internal growth and development programs.
• Supportive culture focused on curiosity, compassion, continuous learning, diversity, and inclusion, with annual retreats and team events.