Lead Cybersecurity Engineer

Job Description

The Lead Cybersecurity Engineer is a senior individual contributor on First Student’s Cybersecurity team, responsible for the day-to-day design, engineering, oversight, and operation of the controls that protect First Student’s cloud, endpoint, application, and identity environments. The role leads cybersecurity engineering projects, drives detection and response engineering, and serves as a senior technical resource for cybersecurity investigations and cross-functional partnership with I&O, Data, and Application teams. This is a hands-on practitioner role. The individual is expected to lead engineering execution, mentor junior team members, and provide technical oversight and peer review of the team’s work product within cybersecurity. Identify and assess

• Perform cybersecurity assessments and technical reviews for new platforms, cloud services, identity/authN/authZ changes, and externally-facing systems. Securely build and protect

• Engineer and lead operations of cybersecurity controls and cloud security posture management. Monitor, hunt, and detect

• Own the technical integration of First Student systems and log sources into the managed MDR platform, and coordinate with the MDR provider on detection use cases, scenario-based workshops, and joint investigations. Respond, recover, and sustain

• Serve as a senior technical lead for cybersecurity incidents, directing investigation, evidence collection, and containment across identity, endpoint, cloud, and email in coordination with I&O and MDR partners. Govern and manage risk

• Contribute technical content to policies and standards (e.g., Vulnerability Management, cloud security, SDLC). Lead and coordinate

• Provide technical oversight and peer review of the cybersecurity team’s work product.

• Mentor cybersecurity analysts and junior engineers on cloud cybersecurity, investigations, and secure design; support individual growth plans in coordination with the Senior Director.

Skills and Requirements

10+ years of IT experience 5+ years in Cybersecurity Engineering, Cloud Security, or DevOps Security Experience supporting both cloud and on-prem environments AWS is a required technology AWS Security Engineering (IAM, GuardDuty, Security Hub, CloudTrail, Control Tower, etc.) Incident Response / EDR experience Infrastructure, Cloud, or DevOps security background Python or PowerShell scripting (Python preferred) Vulnerability Management experience Experience partnering with Infrastructure and Application Development teams Ability to work independently and own security initiatives CrowdStrike Falcon Microsoft Active Directory / Hybrid Identity SAST & DAST (Application Security) MDR / Managed Detection & Response experience Experience assessing security risks related to AI adoption Experience mentoring junior analysts or security engineers Knowledge of NIST CSF, CIS Controls, and AWS security benchmarks

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to [email protected].