Principal Security Engineer, Turnitin

• We are looking for someone who brings passion, security experience, attention to detail, and the willingness to continuously learn
• 5-7 years experience in IT and information security, 3 of which must be in information security
• Strong experience in securing cloud platforms (AWS, GCP, or Azure)
• Expert knowledge of endpoint security best practices (Windows and/or MacOS)
• Strong experience in configuring and using a variety of security tools (IAM solutions, IDS/IPS, Vulnerability Scanners, SIEM, EDR / XDR solutions, Secure Email Gateways, and Log Management Systems) and understanding of best practices relating to their use
• Strong relationship management experience in influencing and motivating internal functions with minimal direction
• Hands-on experience with analysis and deployment Infrastructure as Code tooling
• Proven track record building productive relationships with key business leaders and senior stakeholders in technology and the business
• Ability to provide a balance of strategic planning and tactical execution
• Experience assisting/leading security incidents with demonstrable experience across the full lifecycle of an incident
• Experience automating manual processes to improve the efficiency of day-to-day tasks and provide metrics to demonstrate success
• Retains up-to-date knowledge of security architecture and security risk trends
• Knowledge of CIS and/or NIST frameworks
• Understanding of security principles with the ability to communicate security concepts to non-technical and technical audiences with ease
• Working knowledge of industry security standards (SOC2, FedRamp / StateRamp, ISO 27001)
• Working knowledge of networking and firewall concepts

Desirable

• Must be available to work 2PM-10PM BST/GMT
• You will work within the Information Security & Compliance team and report directly to the Information Security Manager where you will have an opportunity to shape the security operations function for the global leader in educational technology
• The Principal Security Engineer position is a hands-on role that requires a high level of technical expertise
• Responsible for a broad range of tasks including a mix of daily operational tasks as well as strategic planning, engineering, and operational functions
• This position requires proficient in scripting, well-versed in technical security engineering, operations, and management of information security tools and processes such as Incident Response (IR), Security Information and Event Management (SIEM), Intrusion Detection System (IDS), Cloud Security Posture Management (CSPM), Data Loss Prevention (DLP), Vulnerability Management, Identity and Access Management (IAM), Privileged Access Management (PAM), Endpoint Security, file integrity monitoring, vulnerability and risk assessment, penetration testing, malware analysis, digital forensics, and encryption
• As a Principal Security Engineer, you will provide support to protect Turnitin’s digital networks and information, your duties and responsibilities will include the following:
• Act as an escalation point to investigate sensitive and complex security events and incidents from a wide variety of cybersecurity technologies, including; Endpoint Detection and Response (EDR), Email Protection, Cloud Native Application Protection Platform (CNAPP) and Security Information and Event Management (SIEM)
• Evaluate new security technologies and tools, recommending the adoption of those that align with our security objectives and goals
• Proactively identifying and mitigating potential cyber threats to our systems and data
• Use threat intelligence to identify potential attacks and develop strategies to prevent them
• Act as an SME for security requirements and solutions on cloud, infrastructure and application projects
• Work closely with the IT leaders, engineering, and DevOps teams to ensure network and application design decisions comply with organizational policies, and appropriately mitigate security risk
• Provide information security expertise to influence the interpretation, development, acquisition, or implementation of complex technical solutions, including security products
• Work closely with the DevOps team to embed vulnerability management best practices into routine operations
• Utilising scripting/coding for security testing and automation
• Develop, define, and communicate security requirements for cloud architecture, enterprise software, IT services, and product design
• Provide expertise on security requirements in system development activities, vulnerability management, policies, standards, and procedures
• Help shape the security strategy for the business
• Define security requirements for baseline system configurations
• Research and recommend security solutions, products, and security controls
• Provide mentoring and training to junior security staff members