{"id":1436065,"url":"https://alion.io/job/carnegie-mellon-university-it-security-engineer-computing-services","title":"IT Security Engineer - Computing Services","company":{"id":13044,"name":"Carnegie Mellon University","domain":"cmu.edu","url":"https://alion.io/company/cmu","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":80,"open_postings":22,"ghost_share":0,"stale_share":0.818,"repost_share":0,"time_to_fill_p50_days":42,"computed_at":"2026-10-27T05:46:45Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Pittsburgh, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":80000,"max_usd":153000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":502},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"C++","optional":false},{"name":"Java","optional":false},{"name":"Linux","optional":false},{"name":"Perl","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Ruby","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-08-20T00:00:00Z","employer_posted_date":"2026-08-20","last_verified_at":"2026-10-27T05:08:17Z","board_verified":true,"closed_at":null,"days_open":68,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":68},"description":"Carnegie Mellon University’s Information Security Office is seeking an IT Security Engineer to help investigate and respond to security incidents across a large, diverse, and technically complex university environment.\nThis is a hands-on security position with a strong focus on incident response, digital forensics, security monitoring, and technical investigation. You will use endpoint, network, application, identity, and other security data to determine what happened, understand the scope and impact of an incident, preserve and analyze evidence, contain threats, and help affected teams recover securely.\nThe environment is broad, and investigations frequently involve unfamiliar systems or technologies. One incident may require analyzing an endpoint compromise, another may involve reconstructing activity from network traffic and logs, while another may require learning enough about an application, operating system, or protocol to understand unexpected behavior.\nYou do not need to be an expert in every technology or security discipline described in this posting. We are looking for strong technical fundamentals, investigative ability, curiosity, sound judgment, clear communication, and the ability to learn unfamiliar systems when an investigation requires it.\nIf you enjoy understanding how systems work beneath the surface, following evidence until you can explain what happened, considering systems from both attacker and defender perspectives, or building tools to answer questions that existing products cannot, you may be a strong fit for this team.\nWhat You’ll Do:\nA significant portion of this position is dedicated to security incident response and digital forensics. Responsibilities include:\nMonitor and investigate alerts generated by network, endpoint, vulnerability, logging, and other security systems.\n\nTriage reported or suspected security events and determine whether they represent security incidents.\n\nConduct technical investigations using endpoint artifacts, network traffic, system and application logs, identity information, and other available evidence.\n\nDetermine the likely root cause, scope, timeline, and impact of security incidents.\n\nPerform or assist with host and network forensic analysis.\n\nIdentify affected systems, accounts, data, and infrastructure and recommend appropriate containment, eradication, and recovery actions.\n\nWork directly with system administrators, network engineers, developers, application owners, researchers, and other members of the university community during investigations.\n\nClearly communicate technical findings, risk, and recommended actions to both technical and non-technical audiences.\n\nMaintain accurate investigation records, evidence, timelines, findings, and incident documentation.\n\nCollect and preserve digital evidence in support of security investigations and authorized legal matters.\n\nAssist with E-Discovery, evidence preservation, chain-of-custody procedures, and other forensic requests when directed by university leadership or the Office of General Counsel.\n\nParticipate in a shared 24x7 on-call rotation supporting security monitoring, incident response, and security infrastructure.\n\nThe position also contributes to the broader work of the Information Security Office. Depending on team needs, current priorities, and your areas of expertise, this may include:\nSupporting vulnerability scanning and vulnerability management services.\n\nHelping campus organizations understand and remediate security vulnerabilities.\n\nSupporting endpoint security, endpoint detection and response, certificate authority, public key infrastructure, and data protection services.\n\nMonitoring, configuring, evaluating, and improving systems used for security detection, investigation, assessment, and response.\n\nEvaluating emerging vulnerabilities, attack techniques, and security threats for relevance to Carnegie Mellon’s environment.\n\nConducting or assisting with authorized security assessments and penetration testing of systems, networks, applications, and services.\n\nProviding security guidance and technical consulting to teams across the university.\n\nResearching, testing, and recommending new security tools and techniques.\n\nDeveloping scripts, utilities, integrations, or other automation that make investigations and security operations more effective.\n\nCreating documentation, technical guidance, and security communications.\n\nParticipating in other Information Security Office projects as needed.\n\nWhat We’re Looking For\nMinimum Qualifications:\nBachelor’s degree or equivalent combination of education, technical training, professional certifications, and relevant experience.\n\nThree or more years of relevant technical experience in information security, information technology, systems administration, networking, software engineering, infrastructure engineering, digital forensics, or a related technical discipline.\n\nHands-on experience with one or more major operating system environments such as Linux, Windows, or macOS.\n\nUnderstanding of fundamental networking, operating system, and application concepts.\n\nAbility to investigate technical problems methodically by gathering evidence, developing hypotheses, testing assumptions, and documenting conclusions.\n\nAbility to analyze logs, system information, network activity, or other technical telemetry.\n\nAbility to evaluate security threats and vulnerabilities in the context of a real environment.\n\nStrong technical problem-solving skills.\n\nStrong written and verbal communication skills.\n\nAbility to work collaboratively with people representing a wide range of technical backgrounds.\n\nSound judgment when handling sensitive information and security incidents.\n\nAbility to independently perform routine duties after appropriate onboarding and training and to recognize when additional expertise or escalation is required.\n\nDirect professional experience in every area covered by this position is not required. Candidates with strong backgrounds in systems, networking, software, infrastructure, or other technical disciplines who can demonstrate security aptitude and investigative ability are encouraged to apply.\nExperience That Would Be Helpful\nExperience in one or more of the following areas is beneficial:\nIncident response and digital forensics, including host or network forensics, endpoint investigation, security monitoring, log analysis, threat hunting, malware analysis, or related investigative work.\n\nSystems and network engineering, including Windows, Linux, macOS, TCP/IP networking, authentication systems, enterprise infrastructure, virtualization, cloud environments, or storage technologies.\n\nSecurity operations, including endpoint detection and response, SIEM, network security monitoring, vulnerability management, certificate management, or data protection technologies.\n\nSecurity assessment, including vulnerability assessment, penetration testing, application security, or evaluating systems from an adversarial perspective.\n\nAutomation and software development, including using Python, PowerShell, shell scripting, Go, Ruby, Perl, Java, C, C++, or other languages to process data, automate workflows, or create technical tools.\n\nDigital evidence and legal support, including E-Discovery, evidence preservation, chain of custody, subpoena response, or interaction with law enforcement.\n\nWorking in higher education, research, or another large and decentralized computing environment.\n\nDepth in one or more technical areas is more important than superficial experience with every technology listed above.\nCandidates who have developed relevant skills through professional work, independent research, home labs, open-source projects, capture-the-flag competitions, security research, academic work, or other substantive hands-on activities are encouraged to describe that experience.\nProfessional certifications such as CISSP, GSEC, GCFE, or other security and technology certifications are welcomed but are not required.\nHow We Work\nCuriosity matters here. Strong candidates tend to want to understand why systems behave the way they do. They are comfortable starting with incomplete information, asking good questions, testing hypotheses, digging beneath product interfaces, and considering how a system might behave differently from what its designers intended.\nWe value people who can combine that curiosity with careful technical reasoning and sound judgment. Security investigations may involve production systems, sensitive data, legal matters, or significant service impact, so creativity must be balanced with appropriate caution and communication.\nWe also value engineers who look for ways to improve how work is performed. That may mean automating a repetitive task, creating a better investigative workflow, developing a small utility, integrating data from multiple systems, or identifying a more effective way to answer an investigative question.\nNo security engineer knows every technology they will encounter. The ability to recognize a gap in your knowledge, research the problem, experiment appropriately, and apply what you learn is an important part of this role.\nAccountability and Decision Making\nThe IT Security Engineer plays an important role in the timely identification, containment, investigation, and prevention of computer and network security incidents.\nAfter an appropriate period of onboarding and training, the engineer is expected to independently handle routine investigations and operational responsibilities. This includes evaluating the severity of security alerts, selecting appropriate investigative techniques, recommending containment or remediation actions, and determining when an issue should be escalated.\nSignificant incidents, sensitive data exposures, major service disruptions, legal matters, notification decisions, and other unusual or sensitive situations are handled collaboratively with senior staff, the Incident Response Coordinator, management, and other university stakeholders as appropriate.\nOn-Call and Other Position Requirements\nThis position participates in a shared 24x7 on-call rotation for security monitoring, incident response, and infrastructure support. On-call responsibilities may occasionally require work outside normal business hours or travel to campus.\nThe position involves access to sensitive security, investigative, institutional, and potentially legally protected information. Appropriate judgment, discretion, and professionalism are essential.\nThe successful candidate must qualify as a U.S. person under the applicable requirements governing this position.\nThis position does not have formal supervisory responsibilities.\nProfessional Development:\nContinued learning is an expected part of the position. Engineers are encouraged to remain current with security technologies, attack techniques, investigative methods, vulnerabilities, and changes in the broader security community through technical research, training, conferences, professional communities, internal knowledge sharing, and independent experimentation.\nIf you meet the core qualifications and believe your technical background, investigative ability, and curiosity would allow you to succeed in this role, we encourage you to apply even if your experience does not match every preferred qualification listed above.\nAre you interested in this exciting opportunity?! Apply today!\nJoining the CMU team opens the door to an array of exceptional benefits.\nBenefits eligible employees enjoy a wide array of benefits including comprehensive medical, prescription, dental, and vision insurance as well as a generous retirement savings program with employer contributions. Unlock your potential with tuition benefits, take well-deserved breaks with ample paid time off and observed holidays, and rest easy with life and accidental death and disability insurance.\nAdditional perks include a free Pittsburgh Regional Transit bus pass, access to our Family Concierge Team to help n...","description_format":"text","description_chars":13104,"description_truncated":true,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Professional development","Vision insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Research Institutes"],"lifecycle":[{"event":"open","at":"2026-09-29T03:14:58Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 107 · green card filings: 6","filings_12m":107,"filings_prev_12m":112,"green_card_filings_12m":6,"median_offered_wage_usd":83296,"route":null,"cap_exempt":true,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":17,"band":"cold","label":"Long shot","p_open":1,"p_active":0.479,"p_room":0.36,"age_days":68,"expected_fill_days":42,"reasons":["conf:0","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-27T05:46:45Z"},"pay":null,"html_url":"https://alion.io/job/carnegie-mellon-university-it-security-engineer-computing-services","json_url":"https://alion.io/job/carnegie-mellon-university-it-security-engineer-computing-services.json","meta":{"generated_at":"2026-10-27T06:24:22Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6452,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":13044},"rest":"https://alion.io/mcp/rest/get_company?id=13044"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcarnegie-mellon-university-it-security-engineer-computing-services"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcarnegie-mellon-university-it-security-engineer-computing-services"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcarnegie-mellon-university-it-security-engineer-computing-services"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/carnegie-mellon-university-it-security-engineer-computing-services\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcarnegie-mellon-university-it-security-engineer-computing-services"}]}