The Security Engineer is responsible for implementing, maintaining and improving security systems, processes and controls in the US/EU WuXi security environment to protect the security and integrity of WuXi AppTec data. The Security Engineer works with security and Shared Service IT colleagues to configure, test, deploy and maintain security technology, investigate incidents and address vulnerabilities. The role contributes to continuous improvement of assigned systems under the direction of the Director Infrastructure and Security. The Security Engineer supports the security of a diverse IT environment that includes desktop services, on-site servers and applications, cloud hosted solutions and mobile solutions.

This is a hybrid job, must be located in Saint Paul MN 

• Implement, configure, maintain and troubleshoot security technologies across the company’s IT environments, including SIEM, EDR, firewalls, IDS/IPS, data loss prevention and mobile device management tools.
• Monitor and triage security alerts, correlate logs across systems and use threat intelligence to identify suspicious activity. Prioritize findings by risk and escalate according to established procedures.
• Investigate cybersecurity incidents, including phishing, malware and unauthorized access. Determine the scope and impact, preserve evidence, coordinate approved containment and recovery actions, and document cases through closure.
• Develop, test and tune security detection rules and alerting use cases to improve threat visibility and reduce false positives.
• Perform vulnerability assessments, validate and prioritize findings, coordinate remediation with IT teams, and verify that security fixes are effective.
• Implement and maintain secure configuration baselines for endpoints, servers, network devices and cloud resources. Identify configuration drift and coordinate corrective actions through established change procedures.
• Support identity and access management controls, including multi-factor authentication, single sign-on, privileged access and periodic access reviews, in collaboration with system and application owners.
• Assess and strengthen the protection of sensitive company information by applying encryption, data masking and appropriate data handling controls in accordance with established security policies and standards.
• Develop and maintain scripts using PowerShell, Python or similar tools to automate repetitive security tasks, enrich investigations and improve reporting and remediation workflows.
• Participate in security reviews of proposed infrastructure, cloud configurations, new systems and significant technology changes before deployment. Identify risks, recommend appropriate controls and escalate design decisions or exceptions for review.
• Support security audits and compliance activities by gathering technical evidence, validating assigned controls against applicable policies and standards, and tracking remediation of audit findings.
• Maintain accurate security documentation, including system configurations, operating procedures, incident response runbooks and change records. Prepare operational metrics and reports that identify trends, control gaps and improvement opportunities.
• Collaborate with security team members and Shared Service IT colleagues to deliver assigned security projects, share technical knowledge and resolve operational issues. Meet agreed deadlines and quality standards, communicate progress and escalate risks or blockers.
• Monitor emerging threats and security developments, assess their relevance to the company’s environment and recommend improvements to security tools, controls and procedures.

Experience / Education            

• 4 years of relevant experience in cyber security roles
• Bachelor’s or equivalent work experience as a Security Engineer
• Certification(s) such as CISSP, CISM, CompTIA Security+ or CompTIA CySA+ are preferred. 

Knowledge / Skills / Abilities:

• Working knowledge of network, server and mobile security, with hands-on experience configuring, maintaining and troubleshooting security technologies such as SIEM, firewalls, access control lists (ACLs), IDS/IPS, data loss prevention and mobile device management tools.
• Practical experience administering and configuring endpoint detection and response (EDR) tools, maintaining endpoint protection policies and performing approved host isolation and remediation actions.
• Ability to analyze and correlate security alerts and logs, investigate cybersecurity incidents and recognize when escalation is required.
• Understanding of vulnerability assessment, risk-based prioritization, remediation tracking and validation of security fixes.
• Practical experience configuring and maintaining security controls in cloud environments such as Microsoft Azure or AWS, including secure cloud configurations, logging and security monitoring.
• Working knowledge of identity and access management, including multi-factor authentication, single sign-on, privileged access, account lifecycle management and access reviews.
• Knowledge of system hardening and secure configuration baselines for endpoints, servers and network devices, including the ability to identify configuration drift and implement and test corrective changes using established procedures.
• Knowledge of controls used to protect sensitive company information, including encryption, data masking and secure data handling, in accordance with established security policies and standards.
• Ability to develop and maintain scripts using PowerShell, Python or similar tools to automate security tasks, support investigations and improve reporting.
• Familiarity with security policies, standards and frameworks such as NIST, CIS or ISO 27001, including the ability to validate technical controls and gather evidence for audits.
• Ability to review proposed infrastructure, cloud configurations and technology changes before deployment, apply basic threat modeling techniques, identify security risks and recommend appropriate controls.
• Ability to maintain clear technical documentation and investigation records, prepare accurate security reports and operational metrics, and communicate findings and recommendations to technical and non-technical stakeholders.
• Ability to collaborate across teams, manage assigned tasks, meet agreed deadlines and identify issues that require guidance or a management decision.
• Working knowledge of network access control, segmentation and microsegmentation, including experience with Cisco Identity Services Engine (ISE) to support device authentication, authorization and network access policies that restrict unauthorized access and lateral movement.
• Practical experience configuring and maintaining DNS and web security tools such as Cisco Umbrella, including managing filtering policies, investigating blocked requests and troubleshooting access issues.

An Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or protected veteran status and will not be discriminated against on the basis of disability

This job description does not state or imply that the above are the only duties and responsibilities assigned to this position.  Employees holding this position will be required to perform any other job-related duties as requested by Management.