Principal Cyber Security Engineer

About the role

This position leads daily engineering, operations, analysis, management, and administration of security tools and processes that protect the bank’s information assets and technology infrastructure. The engineer assesses networks, applications, and systems for vulnerabilities, designs and implements technical solutions, and serves as a technical resource and mentor for associates and business teams.

Key responsibilities

• Research and execute process or system improvements to enhance information security, lead security assessments, identify gaps, and implement risk‑mitigation solutions.
• Maintain up‑to‑date knowledge of industry practices, emerging threats, and technologies; advise management on security protocols and incidents.
• Lead investigation and resolution of security incidents, prepare reports for management, and develop monitoring, alerting, and playbook documentation.
• Identify and evaluate potential threats or vulnerabilities across networks, applications, and systems; compile data from internal and external sources to produce actionable intelligence.
• Assist senior leadership in developing security policies, standards, and strategies, and facilitate their implementation across the bank.
• Provide after‑hours operational support on a rotational basis with minimal travel requirements.

Required profile

• Bachelor’s degree with at least 8 years of experience, or high school diploma/GED with 12 years of experience in systems engineering, networking, or information security.
• Industry‑recognized security certifications such as CISSP or equivalent.
• Strong ability to communicate risks, threats, and vulnerabilities clearly to technical and non‑technical audiences.
• Willingness to participate in rotational after‑hours support.

Required skills

• Proficiency in Python, Perl, and PowerShell scripting.
• Experience with cryptographic implementations.
• Knowledge of security monitoring and alerting tools.
• Understanding of risk management standards, procedures, and data security practices.