Security Engineer

Responsibilities but not limited to:

• Monitor and manage security tools, including XDR/EDR, SIEM, vulnerability scanners, and email security, and review security dashboards and alerts daily.
• Coordinate with the external SOC on alert triage and escalation, document alert dispositions (true positive, false positive, benign), and escalate confirmed incidents.
• Act as first responder on security incidents, handling triage, containment, evidence collection with chain-of-custody documentation, and forensic analysis.
• Develop, tune, and test SIEM detection rules, correlation logic, and SOAR playbooks to improve automated detection and response.
• Conduct proactive threat hunting across endpoint, network, and cloud telemetry, and support purple team exercises with the SOC.
• Monitor threat intelligence sources (NVD, CISA alerts, vendor bulletins), turn relevant advisories into detection signatures, and use them to prioritize vulnerabilities.
• Run vulnerability scans and assessments with tools such as Nessus and Kenna, track remediation and patch compliance, and follow up with IT teams on overdue items.
• Perform web application security assessments (OWASP Top 10) and internal penetration tests, and coordinate external penetration testing engagements and validation of their findings.
• Collect and maintain PCI-DSS compliance evidence, carry out access reviews (AD, AWS IAM) and configuration audits, and support external audits with technical walkthroughs.
• Implement and maintain security controls on AWS cloud infrastructure, including WAF rules, security groups, and network ACLs, and support firewall rule management.
• Support PAM operations, USB and external storage controls (SecurA), endpoint compliance monitoring, and Zero Trust initiatives such as micro-segmentation and identity verification.
• Lead or carry out assigned technical work on security projects such as PAM deployment, tool rollouts, and compliance initiatives.
• Run security awareness training and phishing simulation campaigns, manage the training platform, and track completion rates.
• Handle security account provisioning, access requests, and onboarding/offboarding security checklists, keep policies and runbooks up to date, and produce weekly and monthly security metrics reports.

• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field.
• 4+ years of experience in information security, security engineering, security operations, or IT infrastructure (level I or II based on experience).
• Solid knowledge of network security (TCP/IP, DNS, firewall, VPN, IDS/IPS, network segmentation) and operating system security and hardening (Windows Server, Linux).
• Hands-on experience operating security tools, including SIEM/XDR, endpoint protection, and vulnerability scanners (Nessus, Kenna, Nmap), and with alert analysis, triage, and patch coordination.
• Experience in security incident response and forensic analysis, and knowledge of common attack vectors (phishing, malware, ransomware) and the MITRE ATT&CK framework.
• Familiarity with detection engineering, threat hunting, and security automation, including SOAR platforms and playbook development.
• Scripting skills for security automation (Python, PowerShell, or Bash), and knowledge of penetration testing tools and methods (Burp Suite, Metasploit, OWASP).
• Cloud security experience, preferably AWS (IAM, Security Groups, CloudTrail).
• Experience with PCI-DSS or other compliance frameworks, ideally in retail, and experience working with an external SOC or MSSP is preferred.
• Certifications such as CompTIA Security+, CySA+, CEH, or GSEC are preferred; advanced certifications (CISSP, GCIA, GCIH, SSCP) are a plus.
• Bilingual in Korean and English preferred 

• MON-FRI, 8:30am to 5:30pm 

• $87,450 - 134,200 per year

*Actual compensation will be determined based on relevant experience, qualifications, skills, and other job-related factors.