Cybersecurity Engineer

Role – Cybersecurity Engineer

Role Purpose

The Cybersecurity & Network Engineer is an advanced technical role that serves as a first point of contact for cybersecurity and network-related support and engineering requests, ensuring tickets are accurately captured, prioritized, routed, and resolved within established service levels (SLAs). The role is primarily focused on safeguarding client systems, networks, and data through proactive security monitoring, incident response, risk assessments, and implementation of robust security controls, while also supporting network stability, performance, and availability.

From an engineering perspective, the role emphasizes efficient diagnosis and response—gathering symptoms, validating alerts, reproducing issues when possible, reviewing logs, and applying standard procedures and knowledge resources to restore secure and reliable operations quickly. The Cybersecurity & Network Engineer documents actions taken, client communications, and resolutions with sufficient detail to support continuity, auditability, and accurate time entry, and escalates appropriately when issues require higher-tier expertise, vendor engagement, or broader coordination.

The role supports proactive service delivery through a cybersecurity-first approach, including vulnerability management, control implementation, and risk mitigation, alongside network-focused responsibilities such as performance monitoring, configuration management, and availability optimization. This position drives continual improvement by identifying recurring security risks and network issues and recommending or updating standards, runbooks, policies, and configurations to prevent repeat incidents and strengthen overall client outcomes.

This role also includes backup support for Support Engineers and participation in on-call responsibilities as needed.

Role Summary

Ticket Coordination: Owns tickets through to resolution by establishing a clear troubleshooting plan, driving timely actions from the right resolver groups, and maintaining momentum with disciplined follow-ups; ensures closure includes impact, evidence, and an accurate resolution narrative.

Organization & attention to detail: Maintains audit-ready ticket records (accurate categorization, clean timelines, complete work notes, and evidence) and produces high-quality handoffs/escalation packages that reduce rework and speed resolution.

Communication & coordination: Communicates clearly with clients and internal technical teams, setting expectations early and confirming next steps/owners; provides a consistent update cadence during high-impact work and flags risks, dependencies, and decision points proactively.

Customer service: Uses active listening and support best practices to maintain customer confidence, including calm de-escalation, clear articulation of options/workarounds, and consistent follow-through that protects the client relationship.

Technical aptitude: Diagnoses and resolves advanced-to-complex IT issues using structured troubleshooting and sound technical judgment; translates information between technical and non-technical audiences and escalates with complete context when additional expertise is required.

Billable hours & time entry discipline: Maintains expected billable utilization through efficient execution and accurate time entry (ticket time entry and Payroll Wrap), while applying sound judgment during incidents/high-priority work to protect SLA outcomes and service quality.

Composure under pressure: Remains calm and accurate during spikes and outages; prioritizes work based on impact, makes timely escalation decisions, and drives toward restoration while meeting deadlines and SLAs.

Adaptability: Responds positively to shifting priorities, incidents, and changing client needs by quickly creating structure (next steps, owners, timelines) and maintaining progress even when information is incomplete.

Self-starter & initiative: Works proactively with minimal direction; independently identify blockers, engages the right resources, and drives tickets and communications forward to timely resolution.

Service delivery improvement focus: Detects recurring issues and operational gaps by reviewing patterns across tickets/alerts, then proposes and helps implement improvements (knowledge/runbooks, monitoring tuning, intake standards, routing/process updates) that reduce repeat incidents and rework.

On-call support: Participates in an on-call rotation for after-hours support when assigned, driving restoration with a clear troubleshooting plan, timely updates, and complete handoffs; coordinates escalation when required and travels onsite as needed to complete support tasks.

Roles & Responsibilities

Client Communication & Service Experience

Provide proactive, structured status updates to clients regarding ticket progress, impact, next steps, owners, and expected timelines; adjust communications as new information emerges.

Maintain a high level of customer satisfaction through timely, professional, and responsive communication, including expectation-setting and calm de-escalation during high-impact or time-sensitive issues.

Identify opportunities to improve the client experience based on recurring issues, intake quality, and feedback; recommend and help implement adjustments to communication, intake questions, routing, and follow-up practices to reduce friction and repeat contacts.

Support and enable clients to use service delivery tools/systems (e.g., portals) by reinforcing standard support processes, clarifying required information for faster triage, and guiding adoption that improves request quality and turnaround time.

Support and enable clients to adopt security best practices (e.g., MFA, phishing resistance, safe data handling) by providing clear instructions, documenting requirements, and reinforcing standard security processes.

Internal Coordination & Vendor Liaison

Function as a liaison between clients, technical staff, and vendors to ensure accurate information exchange, clear ownership, and smooth handoffs—especially for complex, security-related or network-related escalated issues.

Develop and maintain strong working relationships with clients, technical staff, and vendors through professional communication, consistent follow-through, and disciplined documentation practices.

Coordinate scheduling constraints, site access requirements, and technical dependencies that impact service delivery; proactively surface blockers, risks, and timeline impacts to keep security and network work on track.

Lead coordination of client changes (e.g., patching, reboots, security updates, and network maintenance) internally and with external parties to confirm scope, timing, approvals, communications, and dependencies prior to execution; perform and document pre- and post-change validation activities.

Ensure service delivery aligns to a security-first approach, prioritizing risk reduction and control validation while supporting network stability, performance, and availability.

Maintain a high standard of accountability by ensuring all coordination, communication, and work execution are fully documented to support auditability, continuity, and SLA alignment

Technical Support and System Monitoring

Review ticket history and related cases to identify recurring issues, security risks, and network patterns; drive appropriate escalation with clear context and recommend next steps to reduce repeat incidents and improve time to resolution.

Diagnose and resolve an advanced range of technical issues across security, hardware, software, and network systems using structured troubleshooting; coordinate with internal teams or vendors as needed to drive timely remediation.

Oversee daily monitoring of critical client system components by validating alerts, assessing impact, and coordinating remediation; recommend monitoring and runbook improvements that strengthen security, stability, and reduce repeat noise.

Support the setup and configuration of new client systems and devices in alignment with standards; verify outcomes and ensure work is fully documented for supportability, repeatability, and security compliance.

Document troubleshooting steps, findings, root cause (when known), and resolution details in the ticketing system in a way that supports repeatability, efficient handoffs, future knowledge reuse, and auditability.

Follow incident and escalation procedures by confirming severity and impact, notifying appropriate stakeholders, and escalating with complete troubleshooting evidence (screenshots, timelines, logs, and relevant context) as needed; support coordinated restoration activities when assigned.

Triage monitoring alerts by validating symptoms, correlating related alarms and events, assessing impact, and distinguishing false positives from actionable incidents before initiating remediation or escalation.

Perform routine support tasks (e.g., service restarts, health checks, reviews, and scheduled maintenance) according to runbooks and maintenance schedules; complete verification steps and document results and follow-up needs.

Support user and device onboarding/offboarding tasks as assigned, including account provisioning, permissions requests, and access changes, while following security and approval requirements and reinforcing least-privilege standards; escalate exceptions as needed.

Maintain accurate and complete configuration and asset details (device inventory, key settings, connectivity details, and security-related configuration information) in designated systems to improve supportability, speed troubleshooting, and support lifecycle tracking.

Coordinate planned maintenance activities by confirming scope, timing, approvals, communications, dependencies, and downtime expectations; complete pre- and post-checks and communicate outcomes and follow-up actions to clients and internal teams.

Implement and manage technical security controls in alignment with standards; validate effectiveness and document changes, outcomes, and exceptions as appropriate.

Conduct vulnerability scans and risk assessments, prioritize remediation based on impact and exploitability, coordinate patching and hardening activities, and verify fixes; document exceptions and compensating controls when needed.

Respond to security incidents by confirming severity and impact, containing threats, coordinating eradication and recovery, and producing complete incident timelines and evidence; perform root-cause analysis when possible and track corrective actions through completion.

Provide on-site technical support for client networking, hardware, and software issues, including hands-on troubleshooting, break/fix support, and validation testing to confirm full-service restoration.

Install, configure, and maintain network equipment and support infrastructure (routers, switches, firewalls, wireless gear, cabling), including firmware/OS updates, backup and restore configurations, and standards-based builds.

Perform end-to-end connectivity diagnostics across LAN/WAN environments (switching, routing, VPN, wireless, ISP circuits) by reviewing topology, interface status, routing tables, VLANs, and logs; implement corrective actions and verify results.

Deliver and reinforce security awareness and operational best practices for clients and internal staff, including phishing resistance, password hygiene, safe data handling, change window discipline, failover expectations, and when to engage vendors or service providers.

Stay current on emerging threats, attacker techniques, defensive capabilities, and network technologies; recommend practical improvements to tooling, configurations, processes, and standards to strengthen security posture and network reliability.

Reporting, Quality, and Continuous Improvement

Identify opportunities for process improvement to increase efficiency, quality, security posture, and overall customer experience; actively participate in quality assurance and service improvement initiatives.

Conduct research on tools, systems, and technologies that enhance service delivery workflows, with a focus on strengthening security controls and improving network reliability.

Complete required training and stay current on service delivery process changes, tool updates (e.g., Dynamics 365), client standards, and evolving cybersecurity threats; incorporate learnings into daily operations, dispatch, and documentation practices.

Create, update, and follow knowledge base articles and runbooks based on resolved tickets; ensure content is clear, repeatable, aligned with current standards, and incorporates both security and network best practices.

Participate in post-incident reviews by providing timelines, evidence, and improvement recommendations; help track corrective actions to completion with an emphasis on preventing future security and network incidents.

Capture lessons learned from escalations and resolutions (including gaps in intake, detection, or response) and incorporate them into improved triage processes, categorization standards, and documentation practices.

Assist in evaluating and piloting workflow improvements (e.g., automation, monitoring optimizations, routing rules) by testing changes, validating outcomes, and documenting measurable results.

Contribute to root cause analysis by documenting contributing factors across security and network domains; recommend and implement preventative actions such as runbook updates, configuration changes, and monitoring improvements.

Identify repetitive support and security tasks and implement automation solutions (scripts, templates, self-service workflows) to reduce manual effort, improve accuracy, and enhance consistency.

Tune monitoring and alerting systems by adjusting thresholds, reducing false positives, improving correlation, and refining escalation criteria to improve signal quality across both security and network monitoring.

Help enforce and maintain standard configurations (baseline settings, agent versions, naming conventions, and security configurations) to improve supportability, compliance, and operational consistency.

Develop, update, and enforce policies, procedures, standards, and runbooks with a security-first approach, ensuring alignment across security and network practices while maintaining auditability and consistency.

Collaborate with infrastructure, endpoint, and network teams to integrate security best practices into designs, deployments, and changes; review risk, dependencies, and rollback plans for high-impact work.

Policy, Process, and Compliance

Ensure work intake, communications, and documentation consistently follow established delivery policies, procedures, and guidelines; raise policy/process gaps or risks when identified.

Maintain accurate, complete, and timely ticket documentation (work notes, contact attempts, evidence, and status changes) to support auditability, continuity, and effective escalations/handoffs.

Ensure daily timekeeping is completed and accurate (ticket time entry and Payroll Wrap), aligning time entries to worked hours and internal expectations; correct discrepancies promptly.

Periodically review ticketing process documentation and related standards; recommend and help implement updates as needed to reflect tool/process changes and improve compliance and consistency.

Key Competencies

Ticket management: Independently owns complex tickets end-to-end by defining a troubleshooting plan, driving next actions, coordinating with resolver groups/vendors, and producing complete closure notes that support future prevention and faster resolution.

Clear communication (client + internal): Leads communications for escalated and high-impact work by setting expectations, providing a consistent update cadence, translating technical details appropriately, and documenting decisions, risks, and next steps.

Organization & attention to detail: Maintains audit-ready documentation and ticket hygiene (accurate categorization, clean timelines, complete work notes/evidence) and creates high-quality handoffs and escalation packages that minimize back-and-forth.

Time management & workload coordination: Balances queue work, follow-ups, maintenance, and incident response by prioritizing based on impact and SLA risk; drives owners and timelines to prevent ticket stalls and aging.

Customer service mindset: Maintains customer confidence during complex and time-sensitive issues through calm ownership, effective de-escalation, clear articulation of options/workarounds, and reliable follow-through.

Technical aptitude (intermediate to advanced): Investigates and resolves complex security related issues using structured troubleshooting, sound judgment, and careful review of system information. Assesses impact, coordinates next steps through to resolution, documents findings, and escalates with clear context when additional expertise is required.

Dynamics 365 & vendor interface awareness: Demonstrates strong command of Dynamics 365 workflows (queue/routing logic, status discipline, required fields) and vendor interfaces to improve ticket data quality, reduce handoff friction, and strengthen reporting accuracy.

Judgment & escalation discipline: Identifies high-impact, aging, or systemic issues early and escalate effectively with complete context; coordinates the right responders, communicates risks/dependencies, and helps drive incidents to restoration and clear ownership of follow-ups.

Analytical/trend awareness: Reviews patterns across tickets and alerts to spot recurring issues, bottlenecks, and SLA risks; turns insights into actionable recommendations (knowledge/runbooks, monitoring tuning, routing/process changes) that reduce repeat work.

Composure under pressure: Stays calm and accurate during outages and competing priorities; makes timely, impact-based decisions, maintains clear communications, and keeps work moving toward restoration.

Continuous improvement: Acts as a force multiplier by mentoring peers, strengthening runbooks/knowledge, and driving practical workflow and monitoring improvements that increase consistency, reduce rework, and improve customer outcomes.

SLA/KPI Success Measures

Proactive monitoring impact: Reduce noise and improve detection by validating alerts, coordinating remediation, and recommending tuning/runbook updates that prevent incidents or shorten time to restore.

SLA performance (resolution & communication): Meet resolution and update expectations through effective troubleshooting, disciplined follow-ups, and high-quality escalations that accelerate downstream work.

Billable utilization: Maintain target billable utilization by resolving tickets and accurately documenting billable time.

Repeat-incident reduction: Demonstrated reduction in repeat tickets through problem identification, knowledge/runbook updates, and monitoring/process improvements.

Post-incident quality: Timely, complete incident timelines and contributions to root cause analysis and corrective actions when assigned.

Payroll Wrap compliance: Complete Payroll Wrap daily in alignment with time entry expectations (accurate alignment to worked hours and ticket time).

Training hours (monthly): Complete at least 2 hours of assigned and role-relevant training each month by required due dates (if applicable).

Ticket aging/backlog health: Reduction of stale tickets through timely follow-ups and accurate status updates.

Knowledge management updates & reviews: Regularly review and update knowledge articles/process documentation based on recurring tickets and client needs; track review completion rate and timeliness of updates following identified changes.