• Implementar y administrar controles de seguridad en AWS (IAM, VPC, EC2, S3, RDS, EKS, entre otros). • Configurar herramientas nativas: GuardDuty, Security Hub, CloudTrail, Config, WAF, Shield, Inspector, Macie. • Monitoreo y respuesta a incidentes (CloudWatch, logs, SIEM, análisis y remediación). • Definir y ejecutar procesos de DRP/BCP (RTO, RPO, backups y pruebas). • Gestionar vulnerabilidades, parches y seguimiento a hallazgos. • Administrar identidades y accesos (IAM, RBAC, MFA, SSO, Secrets Manager). • Asegurar cumplimiento con estándares como CIS, NIST y SOC 2.

• Support the growth and adoption of Phoenix’s managed security services portfolio. • Work closely with Account Managers and Business Development Managers to identify, qualify and progress opportunities. • Act as a trusted specialist resource during customer engagements, service introduction calls and solution discussions. • Present and demonstrate managed security solutions to prospective customers. • Support the creation of high-quality proposals, tenders and bid responses. • Collaborate with service delivery teams to understand service capabilities, operations and customer outcomes. • Deliver enablement sessions to internal sales teams, helping them identify and position managed security opportunities. • Support the development and execution of sales and marketing campaigns. • Maintain accurate pipeline information and contribute to forecasting activities. • Ensure all opportunities are tracked and managed through CRM systems. • Gather customer feedback and contribute to continual service improvement activities. • Identify opportunities for cross-sell and up-sell across the wider Phoenix portfolio. • Maintain awareness of the evolving cyber security landscape and emerging threats affecting customers.

Role Description We’re hiring a Security GRC Engineer to help us build governance, risk, and compliance in a way that actually works in a modern tech organization: pragmatic, automation-friendly, and aligned with agile delivery. This is not a “paperwork” job. You’ll partner closely with engineering, product, workplace, auditors, and security to turn risk management and compliance into clear, usable guardrails and you’ll challenge processes that create friction without improving security. - Risk management that drives decisions - Run lightweight, continuous risk assessment and threat modelings with teams (not once-a-year rituals). - Translate risk into clear options: impact, likelihood, tradeoffs, and recommended actions. - Track remediation plans and provide visibility through simple reporting. - Build practical governance - Maintain and improve security policies/standards so they’re short, actionable, and adopted. - Create control objectives that fit real engineering workflows (CI/CD, cloud, SaaS, identity). - Compliance, without the theater - Support audits and evidence collection with a focus on efficiency and reusability. - Help align our program with recognized frameworks (e.g., NIST) in a pragmatic way. - Develop “compliance-as-code” habits where possible (automated checks, continuous evidence). - Third-party risk (vendors, partners) - Drive assessments, follow-ups, and risk treatment with procurement and stakeholders. - Push for scalable vendor processes (tiering, standard questionnaires, measurable requirements). - Security enablement - Create playbooks, templates, and self-service material that teams can use without heavy guidance. - Coach teams to understand risk and make better security choices early in delivery. Qualifications - Experience in GRC / risk / compliance in a tech environment (security, cloud, SaaS, engineering orgs). - Strong understanding of security fundamentals: identity, access, logging, incident response, cloud shared responsibility, secure SDLC (at a practical level). - Ability to write simple, clear policies/standards and translate requirements into engineering-friendly controls. - Comfort with ambiguity and agility: you can iterate, prioritize, and deliver incremental improvements. - Excellent stakeholder skills: you can influence without authority, challenge respectfully, and get things done. Requirements - Bonus points for experience aligning programs to frameworks (NIST CSF, ISO 27001, SOC 2, etc.). - Experience with vendor risk platforms or automation (workflows, evidence collection, dashboards). - Familiarity with “compliance as code” concepts, continuous controls monitoring, or security tooling. - Experience partnering with product/engineering teams on secure-by-design practices. Benefits - Tailor-made training and coaching program. - Remote working policy. - A wellness program "Pauses" with many activities and animations in-house. - Access to Eutelmed, a digital mental health and well-being platform that allows you to speak with an experienced psychologist. - A healthy and eco-responsible company restaurant. - Individual or family health insurance. - CSE benefits. - A rooftop. - A gym with free classes.

Role Description We are looking for an experienced and knowledgeable Information Security Engineer (Tier 3) to join our team! As an Information Security Engineer, you will be responsible for planning, implementing, and managing the overall security strategy for our managed customers. The ideal candidate should have strong understanding of cloud native SIEM solutions, Endpoint and Network security tools and compliance requirements. - Work closely as part of the team, and be independent to handle incidents, and drive incidents to resolution as well as learning and improving from them. - Collaborate with colleagues on various security projects and contribute towards best practices of processes, technology used and overall security awareness. - Maintain a teamwork mentality, working closely with colleagues on projects, learning from and supporting each other. - Maintain and improve the security technologies deployed, including creating use cases, customizing, or better configuring the tools based on past and current threats. - Adopt a quality service approach, proactively pointing out possible issues, providing detailed reporting, and staying available for support until an issue is resolved. - Be detail-oriented and flexible-minded to contribute to the 24/7 defensive capabilities of the SOC for the overall security of the organization and customers. - Exhibit curiosity, problem-solving mentality, and a keen interest in growing in the security area. - Analyze logs (from Security Information & Event Management system) and other sources to create reports and better prepare for suspicious events or malicious efforts. - Have solid experience working in a SOC environment, with a good understanding of network & application security and vulnerability management. - Possess good communication skills to interact with colleagues locally and internationally from both technical and non-technical backgrounds. - Perform penetration testing, vulnerability scanning, and manage and track remediation of identified vulnerable systems. Qualifications - 5+ years of Information Security experience - Working experience with integration with different security systems and devices - 2+ years coding and scripting experience in Python, Linux shell scripting or Windows Powershell scripting - Working experience and knowledge of SOAR platforms and solutions - 2-4 years of systems analysis - Working knowledge of Linux and syslog from CLI - Experience with computer network/application penetration testing and techniques - Proven ability and experience performing moderately complex security analysis for information technology - Excellent writing and communications skills in English - Familiarization with a variety of information and network security tools (Azure Sentinel SIEM, QRadar SIEM, Splunk, McAfee Security Suite, Cisco IDS/IPS, Tenable Nessus, and Palo Alto, among others) - Familiarization with a variety of Network Access Control software (Cisco ISE, ForeScout, etc.) - SQL or KQL knowledge is considered an advantage - Operational knowledge of API is considered an advantage Education Preferred - Bachelor's degree in computer information systems or related field Industry Certifications - Certified Information Systems Security Professional (CISSP) - Information Systems Security Engineering Professional (CISSP-ISSEP) - Systems Security Certified Practitioner (SSCP) - CompTIA Security+ - Certified Ethical Hacker (CEH) - Certified Security Analyst (ECSA) - Certified Incident Handler (ECIH) - CompTIA Cybersecurity Analyst (CSA+) - Information Technology Infrastructure Library (ITIL) - Cisco CCNA - Cisco CCNP + Security - MCSE - Linux+ Shift - Monday - Friday 8 AM - 5 PM CT, US Business hours (Central) with on-call participation. The shift may be rotated/changed based on support coverage requirements.