Security Engineer

Security Engineer

GXA is seeking a highly capable Security Engineer to support the delivery and operation of our gShield security services. This role is hands-on and technical, focused on security engineering, incident response, security tool operations, remediation execution, client security support, infrastructure security, and internal security improvement initiatives.

The Security Engineer serves as a Tier 3 escalation point for active security and technical issues and plays a key role in operating and improving the gShield security stack across client environments. This individual will work closely with the InfoSec Manager (vISM), vCISO, SOC, Centralized Services, onboarding teams, and internal technical leadership to strengthen client security posture and support rapid, effective response to threats and technical issues.

This is an execution-focused role for someone who is comfortable working across security and the underlying IT infrastructure that supports it. The ideal candidate understands how networks, servers, identity, endpoints, cloud services, and security controls work together and can troubleshoot across these layers when the root cause is not immediately clear.

This person should be comfortable working in live security events, analyzing alerts and evidence, troubleshooting infrastructure and security issues, executing or supporting remediation, and helping maintain the operational excellence of GXA 's security program.
Key Responsibilities
Incident Response
- Serve as a Tier 3 escalation point for active security incidents, including business email compromise (BEC), adversary-in-the-middle (AiTM), ransomware, account compromise, identity-based attacks, and other security events.

- Lead technical analysis during incident response and war room events, including log review, IOC hunting, attacker activity analysis, and lateral movement tracing.

- Execute containment and eradication actions such as endpoint isolation, session revocation, credential resets, access restriction, and other appropriate remediation actions.

- Troubleshoot incidents that may span multiple technical layers, including identity, endpoints, servers, networking, cloud services, and security controls, to distinguish security events from underlying infrastructure issues.

- Coordinate with SOC teams, infrastructure teams, and vendor threat intelligence teams during active investigations and containment efforts.

- Maintain a calm and methodical approach during high-impact incidents, working through available evidence and technical dependencies rather than relying on assumptions.

- Communicate clearly during active incidents, including what is known, what has been investigated, what actions have been taken, what is being investigated next, and where additional support is required.

- Produce accurate incident timelines, technical findings, and evidence packages for vCISO review and client-facing follow-up.

Tool Operations & Security Stack Support
- Operate daily within the gShield toolstack, including platforms such as Huntress, Microsoft Defender for Endpoint (MDE), Cyrisma, DNSFilter, SIEM, and related security technologies.

- Perform alert triage, risk identification, scan issue resolution, investigation, and follow-through on issues surfaced by security tools.

- Support SIEM operations including query development, alert review, log analysis, investigation, and rule tuning.

- Assist in tuning detection logic, scan settings, and platform effectiveness in coordination with Centralized Services and security leadership.

- Monitor for security gaps, suspicious activity, configuration weaknesses, and control failures across managed environments.

- Correlate information across identity, endpoint, network, server, and cloud sources when investigating security issues.

- Work within established security standards, baselines, and operational policies defined by the security team and vITMs.

Infras