Lead, Infrastructure Security Engineer

What You’ll Do:

Vulnerability Management

• Own the vulnerability management lifecycle end-to-end — scanning, prioritization, remediation tracking, reporting, and exception management. • Deploy and maintain vulnerability scanning infrastructure, including credentialed scanning across servers, network devices, and endpoints. • Develop risk-based prioritization frameworks that account for asset criticality, exploit availability, and business context. • Build remediation tracking and SLA reporting processes in partnership with Infrastructure and IT teams. • Manage vulnerability exception and risk acceptance workflows.

On-Premises Infrastructure Security

• Secure on-premises Active Directory — tiered administration model, GPO hardening, service account hygiene, privileged group management. • Implement and maintain secure configuration baselines for Windows and Linux servers (CIS Benchmarks, DISA STIGs, or equivalent). • Coordinate patching schedules and change management with Infrastructure, ensuring timely remediation without impacting operations. • Conduct security assessments for new infrastructure deployments and third-party integrations.

Network & Physical Environment Security

• Implement and maintain network segmentation — VLANs, firewall policies, IDS/IPS, and access control lists. • Secure remote access infrastructure — VPN, jump boxes, privileged access management. • Partner with the Infrastructure team on network architecture reviews and security hardening. • Maintain documentation of network security architecture, diagrams, and configurations.

Legacy & Manufacturing Environment Security

• Secure legacy and manufacturing floor environments that cannot be patched or upgraded — microsegmentation, compensating controls, risk acceptance documentation. • Implement monitoring for unmanaged and OT assets — device inventory, network isolation, anomaly detection. • Partner with Quality/Regulatory on FDA-validated system constraints and re-qualification requirements • Drive decommission planning for end-of-life systems.

What You Bring:

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field preferred; equivalent professional experience or in-progress degree considered. • Industry certifications preferred: CISSP , CompTIA Security+, CySA+, GIAC (GSEC, GCSA), or equivalent. • 4+ years of progressive experience in infrastructure security, security engineering, or related cybersecurity roles. • Demonstrated vulnerability management experience — deployment and operation of scanning platforms (Tenable/Nessus, Qualys, or equivalent), credentialed scanning, and risk-based prioritization. • Strong Active Directory and Windows Server security knowledge — tiered administration, GPO, service account management, domain hardening. • Network security depth — segmentation, firewall management, IDS/IPS, VPN, and routing/switching security. • Experience with secure configuration baselines (CIS Benchmarks, DISA STIGs) and compliance scanning. • Medical device, healthcare, or regulated industry experience preferred. • Strong communication and collaboration skills.