Torchora
Back to Home

Key Responsibilities and Required Skills for Information Security Engineer

💰 $ - $

Information SecurityCybersecurityEngineering

🎯 Role Definition

We are seeking an experienced Information Security Engineer (also titled Security Engineer, InfoSec Engineer, or Cybersecurity Engineer) to design, implement, and operate security controls that protect systems, applications, and cloud infrastructure. This role focuses on proactive threat detection, vulnerability management, secure architecture, incident response, and cross-functional enablement of secure development and deployment processes. The ideal candidate combines hands‑on technical expertise (SIEM, EDR, cloud security, IAM, networking, SAST/DAST) with strong process orientation and experience implementing security at scale across hybrid and cloud-native environments.

📈 Career Progression

Typical Career Path

Entry Point From:

  • Security Analyst / SOC Analyst
  • Network Engineer or Systems Administrator with security focus
  • Application Developer with DevSecOps exposure

Advancement To:

  • Senior Information Security Engineer / Lead Security Engineer
  • Security Architect / Cloud Security Architect
  • Manager of Security Operations / Head of Security Engineering

Lateral Moves:

  • Threat Hunter / Incident Response Specialist
  • Cloud Security Engineer / DevSecOps Engineer
  • Compliance & Risk Analyst / GRC Specialist

Core Responsibilities

Primary Functions

  • Design, implement, and maintain scalable security controls across cloud (AWS, Azure, GCP) and on-prem environments to protect data, workloads, and services in accordance with NIST, ISO 27001 and organizational security strategy.
  • Operate and optimize Security Information and Event Management (SIEM) platforms (e.g., Splunk, Elastic Security, Azure Sentinel) including rule development, alert tuning, log collection, retention strategy and playbook integration for reliable threat detection and monitoring.
  • Lead incident response and digital forensics investigations: triage alerts, coordinate containment and eradication, perform root cause analysis, produce incident reports, and recommend remediation and lessons learned.
  • Manage vulnerability management lifecycle: discover and prioritize vulnerabilities using vulnerability scanners (Qualys, Tenable, Rapid7), validate findings, coordinate remediation with engineering teams, and track SLAs to reduce exposure.
  • Implement and enforce Identity and Access Management (IAM) best practices: least privilege, role-based access control (RBAC), privileged access management (PAM), multi-factor authentication (MFA), and lifecycle management for users and service accounts.
  • Harden hosts, containers, and infrastructure: develop and apply secure baseline configurations, CIS benchmarks, container image scanning, runtime protection and system hardening across Linux, Windows, and container orchestration platforms (Kubernetes).
  • Integrate security into the software development lifecycle (SDLC): implement SAST, DAST, software composition analysis (SCA), pre-commit hooks, CI/CD pipeline security, and developer security training to shift left on risk.
  • Build and maintain automation (IaC scanning, remediation scripts, CloudFormation/Terraform policies) to enforce security guardrails and reduce manual toil, using tools like HashiCorp Sentinel, AWS Config, or Open Policy Agent (OPA).
  • Conduct threat modeling and risk assessments for new features, architectures, and third-party integrations to identify attack surfaces and propose mitigations that align with business risk appetite.
  • Design and maintain network security controls: firewall rulesets, network segmentation, micro-segmentation, secure VPNs, WAF tuning and DDoS mitigation strategies to reduce lateral movement and surface area.
  • Perform threat hunting using telemetry from EDR/EDR-like tools (CrowdStrike, Carbon Black, Microsoft Defender), network logs, DNS and proxy logs to proactively detect advanced threats and anomalous behavior.
  • Develop and maintain security runbooks, playbooks, SOPs, and run regular tabletop exercises to validate team readiness and mature incident response capabilities.
  • Evaluate, onboard, and manage third-party security tooling and vendors (MSSPs, MDR, bug bounty platforms) including procurement, performance metrics, and contract security requirements.
  • Maintain and improve patch management processes across endpoints, servers, and critical infrastructure, coordinating with platform and application owners to reduce mean time to remediation (MTTR).
  • Implement data protection controls: encryption at rest and in transit, key management practices, data classification, and secure data lifecycle management to meet regulatory and contractual obligations.
  • Define and measure security KPIs and metrics (MTTR, mean time to detect, patch timelines, exposure windows, control coverage) and report security posture to engineering leaders and executives.
  • Ensure compliance and audit readiness for relevant standards and regulations (PCI-DSS, SOC2, GDPR, HIPAA) by implementing controls, evidence collection processes and remediation plans for audit findings.
  • Collaborate with product, engineering, and platform teams to provide security architecture reviews, threat mitigations, and secure-by-design guidance for new initiatives and feature rollouts.
  • Maintain and test business continuity and disaster recovery security plans, ensuring backups are protected, tested and aligned with RTO/RPO requirements.
  • Conduct regular penetration tests, red team engagements, and coordinate external assessments; triage findings and drive remediation trackings to closure.
  • Mentor, train and enable developers, SREs, and operations teams on practical security controls, secure coding practices, and incident response duties to build a strong security culture.
  • Research and pilot emerging security technologies and techniques (zero trust, confidential computing, runtime application protection) to continually evolve defenses against modern threats.

Secondary Functions

  • Support ad-hoc security requests and investigations from internal teams, including risk reviews and evidence collection for audits.
  • Contribute to the overall security strategy, roadmaps, and policy development while aligning tactical projects to strategic security objectives.
  • Provide security input to procurement and vendor onboarding processes, evaluating vendor security posture and contractual requirements.
  • Participate in agile ceremonies and sprint planning with platform and application teams to ensure security tasks and user stories are appropriately prioritized and tracked.
  • Maintain knowledge base articles, runbooks and internal training materials to improve cross-team security literacy and operational consistency.
  • Assist in remediation coordination by tracking open vulnerabilities, monitoring deadlines, and escalating blockers to management when necessary.
  • Help build and maintain automated dashboards and reporting used by security operations and engineering leadership to make data-driven decisions.
  • Collaborate with legal, compliance and privacy teams to ensure security measures support data privacy and regulatory obligations.
  • Participate in community threat intelligence sharing and industry groups to stay current on adversary tactics, techniques and procedures (TTPs).
  • Provide on-call support for incident response rotation and contribute to after-action reviews that feed continuous improvement.

Required Skills & Competencies

Hard Skills (Technical)

  • Proficient in designing, deploying and operating SIEM solutions (e.g., Splunk, Elastic, Azure Sentinel) including log parsing, correlation rules, and alert management.
  • Hands-on experience with EDR/XDR platforms (CrowdStrike, Carbon Black, Microsoft Defender, SentinelOne) for detection, containment and endpoint forensics.
  • Strong cloud security skills across AWS, Azure, and/or GCP: IAM, VPC architecture, security groups, KMS, cloud-native logging and monitoring, and cloud misconfiguration remediation.
  • Vulnerability management expertise: scanning, prioritization, validation, remediation workflows and familiarity with tools like Tenable, Qualys or Rapid7.
  • Solid knowledge of identity and access management (SAML, OAuth2, OIDC, RBAC, SCIM) and experience implementing MFA and privileged access solutions.
  • Experience with container and orchestration security (Kubernetes hardening, image scanning, runtime security) and container-native tooling (Pod Security Policies, OPA/Gatekeeper).
  • Familiar with secure coding practices and application security tooling: SAST (SonarQube, Checkmarx), DAST (OWASP ZAP, Burp Suite), and software composition analysis (Snyk, Black Duck).
  • Networking security fundamentals: TCP/IP, firewalls, VPNs, IDS/IPS, DDoS mitigation and network segmentation strategies.
  • Automation and Infrastructure-as-Code (IaC) skills: Terraform, CloudFormation, scripting (Python, Bash), and policy-as-code (OPA, Sentinel).
  • Incident response and digital forensics capabilities, including log analysis, memory forensics, and evidence preservation.
  • Familiarity with compliance frameworks and controls mapping: NIST CSF, CIS Controls, ISO 27001, SOC2, PCI-DSS, GDPR.
  • Experience integrating security into CI/CD pipelines (Jenkins, GitLab CI, GitHub Actions) and securing artifact repositories and container registries.
  • Proficiency with monitoring and telemetry platforms, log storage, and analytics tools to build metrics and dashboards for security operations.
  • Knowledge of encryption algorithms, PKI, TLS, key management and secure certificate lifecycle management.
  • Experience with security orchestration, automation, and response (SOAR) platforms or automation playbooks.

Soft Skills

  • Strong problem-solving mindset with the ability to triage complex incidents under time pressure and uncertainty.
  • Excellent written and verbal communication skills for producing incident reports, risk assessments, and security guidance targeted at technical and non-technical stakeholders.
  • Collaborative team player who can influence engineers, product managers and leadership to prioritize security work without blocking delivery.
  • High degree of ownership, accountability, and bias for action when driving security initiatives to completion.
  • Ability to translate business objectives and risk tolerance into practical security controls and measurable outcomes.
  • Continuous learner: curiosity about attacker techniques, new tooling, and best practices to proactively evolve defenses.
  • Strong organizational skills and attention to detail for tracking remediation, audit evidence, and security documentation.
  • Coaching and mentoring skills to upskill engineers and build security champions across product and platform teams.

Education & Experience

Educational Background

Minimum Education:

  • Bachelor's degree in Computer Science, Information Security, Cybersecurity, Information Technology, or a related technical discipline — or equivalent practical experience.

Preferred Education:

  • Master's degree in Cybersecurity, Information Assurance, Computer Science, or related field.
  • Industry certifications such as CISSP, CISM, OSCP, GCP/AWS/Azure Security Specialty, CEH, or GIAC certifications (GCIH, GCIA, GPEN).

Relevant Fields of Study:

  • Computer Science
  • Information Security / Cybersecurity
  • Information Systems
  • Software Engineering
  • Network Engineering

Experience Requirements

Typical Experience Range:

  • 3–7+ years of hands-on experience in information security, security engineering, or related roles. (Mid-level: 3–5 years; Senior: 5–10+ years)

Preferred:

  • Demonstrated experience operating security tools (SIEM, EDR, vulnerability scanners), responding to incidents, and deploying security in cloud-native architectures.
  • Experience working in Agile/DevOps environments and integrating security into fast-moving CI/CD pipelines.
  • Track record of improving security posture at scale, reducing exposure windows, and delivering measurable security KPIs.
  • Prior experience in regulated industries (finance, healthcare, e-commerce) or with compliance frameworks (PCI-DSS, SOC2, ISO 27001, GDPR) is a strong plus.
Explore More Careers