• Configure and manage firewalls (e.g., Palo Alto) to protect network infrastructure and prevent unauthorized access • Manage encryption protocols (e.g., AES) to ensure data confidentiality and integrity across the organization • Deploy and maintain Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) to detect and mitigate threats in real-time • Utilize penetration testing tools (e.g., Metasploit) to identify vulnerabilities and assess the security posture of systems and applications • Analyze logs using the ELK Stack (Elasticsearch, Logstash, Kibana) to detect anomalies, investigate incidents, and enhance security monitoring • Develop and implement risk assessment models to evaluate potential security risks and prioritize mitigation efforts • Collaborate with cross-functional teams to align cybersecurity strategies with business objectives and IT strategies • Develop and maintain comprehensive documentation for cybersecurity processes, configurations, and procedures • Stay current with emerging cybersecurity technologies, trends, and best practices • Participate in the procurement and evaluation of cybersecurity tools and software • Ensure compliance with industry regulations and internal policies in all cybersecurity efforts • Conduct regular reviews and audits of cybersecurity processes to identify areas for improvement • Contribute to the continuous improvement of cybersecurity strategies and methodologies • Engage in knowledge-sharing activities and training sessions to enhance team skills and capabilities

• Independently manage and resolve DSCSA serialization and traceability exceptions impacting Mail and Specialty product flow, including quarantined inventory. • Perform advanced investigation across SAP, TraceLink SCWM, and related systems to analyze purchase orders, receipts, inventory movements, scan data, and EPCIS transactions. • Reconcile discrepancies across multiple systems and data sources, identifying root causes and implementing corrective actions. • Investigate and resolve cross-system timing or data mismatches that result in receiving or compliance failures. • Ensure all exception handling aligns with DSCSA requirements, internal SOPs, and audit standards • Document investigations, actions taken, and outcomes in a clear, consistent, audit-ready manner. • Serve as a point of escalation for complex, high-risk, or recurring exceptions, providing guidance to analysts and operational partners. • Partner with IT, Compliance, Operations, and external trading partners to resolve systemic issues and support long-term fixes. • Identify trends and recurring issues, contributing to process improvements, training materials, and preventive controls. • Support enterprise readiness by maintaining strong awareness of DSCSA milestones, regulatory guidance, and system changes.

• The Director of Security & Infrastructure is a hands-on technical leadership role responsible for maintaining a robust security posture and reliable infrastructure operations across Highway's technology platform. • This role owns the security of our application, AWS environment, and endpoints while ensuring the performance, scalability, and availability of our infrastructure. • You'll work closely with the VP of Engineering and senior engineering team to embed security into development practices and maintain operational excellence. • This is not a pure policy or compliance role - we need someone who can architect solutions, configure tools, and respond to incidents while also building frameworks and processes that scale with our growth.

• The Security Engineer manages Information Technology security protections with the goal of protecting PPFA from and reducing the impact of security incidents and system compromises for the organization. • This position provides security monitoring, event investigation and analysis, and countermeasure proposals on a 24x7 basis along with providing support and guidance to Tier I Analysts, will provide technical assistance for Tier II & III incidents as assigned, and is responsible to directly interface with the InfoSec Operations Team, Managed Security Service Provider (MSSP) and IT Managed Service Provider (MSP) as it relates to security event architecture, collection, management, reporting, and alerting within PPFA’s SIEM Platforms. • The Security Engineer will engage with InfoSecOps, InfoSec, ITOps/MSP, the MSSP, ATS and staff within both PPFA and Affiliates. • The Security Engineer will deliver by identifying, implementing, and maintaining Information Security toolsets, primarily focused on SIEM, to protect the organization; interfacing with IT Ops to ensure proper security event logging setup; and, where applicable, supporting the Information Security SIEM management needs of PPFA and Affiliates. • Act as a Subject Matter Expert for PPFA’s SIEM (currently Splunk) and be able to configure, manage, operate, and administer the platform from a managed SIEM perspective. • SIEM Security Monitoring – Provide security monitoring and threat/risk analysis in a 24/7 environment. • SIEM Event Filtering – Monitor & ensure established processes for event identification are followed, and, where required, make recommendations for new or refined event filtering, ensuring all updates are completed. • SIEM Event Investigation & Assignment – Monitor & ensure established processes are followed for collecting relevant data and performing the necessary levels of analysis on that data. Ensure events are assigned appropriately. • Tier II Event Escalations - Follow an established process for handling Tier II escalations, identifying the source of the escalation (MSSP, MSP, Affiliate, or other) and the appropriate triage and documentation processes. • Creating and maintaining Standard Operating Procedures (SOPs) for the Information Security Ops group, and providing recommendations on security process improvements. • Support and engage on complex security tool-specific tasks with the assistance and guidance of management, vendor & MSSP resources. • Assist in Vulnerability Assessments setup, scanning, analysis, and remediations, working with IT Ops staff and corporate vendors as needed in correcting errors and alerts as found with the IT infrastructure systems. • Assist in IR incidents as assigned by management. • All other duties as assigned.