{"id":819609,"url":"https://alion.io/job/gxait-security-engineer","title":"Security Engineer","company":{"id":674072,"name":"GXA IT Consulting","domain":"gxait.com","url":"https://alion.io/company/gxait","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"B","score":75,"open_postings":5,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"contractor","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["PK","ZA","LK"],"hiring_countries_total":3,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"DHCP","optional":false},{"name":"DNS","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false},{"name":"Windows Server","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"CIS Benchmarks","optional":true},{"name":"Hyper-V","optional":true},{"name":"Microsoft Sentinel","optional":true},{"name":"PowerShell","optional":true},{"name":"VMWare","optional":true},{"name":"Zero Trust","optional":true}],"status":"live","first_seen_at":"2026-08-18T00:00:00Z","employer_posted_date":"2026-08-18","last_verified_at":"2026-11-04T06:59:57Z","board_verified":true,"closed_at":null,"days_open":78,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":78},"description":"Security Engineer\nGXA is seeking a highly capable Security Engineer to support the delivery and operation of our gShield security services. This role is hands-on and technical, focused on security engineering, incident response, security tool operations, remediation execution, client security support, infrastructure security, and internal security improvement initiatives.\nThe Security Engineer serves as a Tier 3 escalation point for active security and technical issues and plays a key role in operating and improving the gShield security stack across client environments. This individual will work closely with the InfoSec Manager (vISM), vCISO, SOC, Centralized Services, onboarding teams, and internal technical leadership to strengthen client security posture and support rapid, effective response to threats and technical issues.\nThis is an execution-focused role for someone who is comfortable working across security and the underlying IT infrastructure that supports it. The ideal candidate understands how networks, servers, identity, endpoints, cloud services, and security controls work together and can troubleshoot across these layers when the root cause is not immediately clear.\nThis person should be comfortable working in live security events, analyzing alerts and evidence, troubleshooting infrastructure and security issues, executing or supporting remediation, and helping maintain the operational excellence of GXA's security program.\nKey Responsibilities\nIncident Response\nServe as a Tier 3 escalation point for active security incidents, including business email compromise (BEC), adversary-in-the-middle (AiTM), ransomware, account compromise, identity-based attacks, and other security events. \nLead technical analysis during incident response and war room events, including log review, IOC hunting, attacker activity analysis, and lateral movement tracing. \nExecute containment and eradication actions such as endpoint isolation, session revocation, credential resets, access restriction, and other appropriate remediation actions. \nTroubleshoot incidents that may span multiple technical layers, including identity, endpoints, servers, networking, cloud services, and security controls, to distinguish security events from underlying infrastructure issues. \nCoordinate with SOC teams, infrastructure teams, and vendor threat intelligence teams during active investigations and containment efforts. \nMaintain a calm and methodical approach during high-impact incidents, working through available evidence and technical dependencies rather than relying on assumptions. \nCommunicate clearly during active incidents, including what is known, what has been investigated, what actions have been taken, what is being investigated next, and where additional support is required. \nProduce accurate incident timelines, technical findings, and evidence packages for vCISO review and client-facing follow-up. \nTool Operations & Security Stack Support\nOperate daily within the gShield toolstack, including platforms such as Huntress, Microsoft Defender for Endpoint (MDE), Cyrisma, DNSFilter, SIEM, and related security technologies. \nPerform alert triage, risk identification, scan issue resolution, investigation, and follow-through on issues surfaced by security tools. \nSupport SIEM operations including query development, alert review, log analysis, investigation, and rule tuning. \nAssist in tuning detection logic, scan settings, and platform effectiveness in coordination with Centralized Services and security leadership. \nMonitor for security gaps, suspicious activity, configuration weaknesses, and control failures across managed environments. \nCorrelate information across identity, endpoint, network, server, and cloud sources when investigating security issues. \nWork within established security standards, baselines, and operational policies defined by the security team and vITMs. \nInfrastructure & Security Engineering\nApply security principles across on-premises, cloud, and hybrid client environments. \nTroubleshoot security issues involving underlying infrastructure components such as Active Directory, Microsoft Entra ID, Windows servers, endpoints, DNS, networking, firewalls, VPNs, virtualization, and cloud services. \nUnderstand how identity, network connectivity, endpoints, servers, cloud platforms, and security controls interact, and use that understanding to troubleshoot complex issues. \nSupport security hardening of Windows, endpoint, identity, network, and cloud environments. \nAssist with identity and access security including MFA, Conditional Access, privileged access, authentication, authorization, and account security. \nSupport endpoint and server security controls, patching, configuration improvements, and remediation activities. \nWork effectively with technologies that may be unfamiliar by researching, testing, validating, and documenting appropriate solutions while escalating appropriately when additional expertise is required. \nClient Delivery Support\nExecute technical remediation items identified through MRMMs, preventative actions, vulnerability reviews, and security recommendations. \nSupport gShield deliverables through technical validation, evidence gathering, scan review, vulnerability analysis, and remediation validation. \nAssess vulnerabilities based not only on severity scores but also on asset criticality, exposure, exploitability, existing controls, and business impact. \nWork with client and internal technical teams to remediate vulnerabilities and security weaknesses, including identifying appropriate compensating controls when immediate remediation is not possible. \nValidate remediation and confirm that identified risks have been appropriately addressed. \nAct as a quality assurance resource for client onboarding into the gShield toolstack, while execution remains with onboarding and Centralized Services teams. \nAssist with client hardening efforts and follow-through on security improvement actions across managed environments. \nSupport multiple client environments with different infrastructure, configurations, security tools, and levels of technical maturity. \nInternal Security Posture\nSupport remediation of internal GXA security backlog items, including POA&M-related work. \nAssist with rollout and support of phishing-resistant MFA, passkeys, and other internal security initiatives. \nContribute to security engineering efforts related to Intune, Defender, ThreatLocker, AppLocker, and RMM scripting. \nHelp improve internal security controls, tool effectiveness, and technical enforcement mechanisms. \nSupport security hardening and remediation across internal identity, endpoint, server, network, and cloud environments where needed. \nDocumentation & Process Improvement\nWrite and maintain security engineering SOPs, runbooks, detection playbooks, troubleshooting procedures, and response procedures related to gShield operations and incident response. \nDocument technical findings, repeatable procedures, remediation steps, and lessons learned from incidents and tool operations. \nClearly document what was identified, what actions were taken, why those actions were taken, and what follow-up is required. \nCollaborate with security leadership and technical stakeholders on process improvements, skill development, and automation opportunities. \nContribute technical depth to broader security documentation where needed, while recognizing that ownership of policy, standards, and governance documentation remains with security leadership and related functions. \nQualifications\n5-7+ years of experience across cybersecurity, security engineering, infrastructure engineering, network engineering, security operations, or related technical roles. \nStrong technical foundation across IT infrastructure and security, with practical understanding of networking, servers, identity, endpoints, cloud services, and how these technologies interact. \nHands-on experience troubleshooting on-premises, cloud, or hybrid environments. \nWorking knowledge of infrastructure technologies and concepts such as Active Directory, Windows Server, DNS, DHCP, TCP/IP, routing, switching, VLANs, VPNs, firewalls, and virtualization. \nStrong hands-on experience with security engineering, threat detection, security operations, incident investigation, or incident response workflows. \nExperience working with security platforms such as Microsoft Defender, Huntress, DNSFilter, SIEM solutions, vulnerability management tools, and endpoint security technologies. \nAbility to investigate security alerts, analyze logs, trace attacker activity, determine scope, and support containment and remediation. \nFamiliarity with common attack types including phishing, BEC, account compromise, ransomware, identity-based attacks, and endpoint compromise. \nExperience supporting security controls within Microsoft 365, Microsoft Entra ID, endpoint, and cloud environments. \nUnderstanding of vulnerability management and remediation, including prioritization based on technical severity, exposure, asset criticality, and business risk. \nAbility to independently troubleshoot technical problems, develop and test hypotheses, identify root causes, and recognize when escalation or additional expertise is appropriate. \nAbility to remain calm, structured, and methodical during active incidents, outages, and technical escalations, including situations where the root cause is initially unknown. \nStrong verbal and written communication skills, with the ability to provide concise technical updates explaining current status, actions completed, current investigation, and next steps. \nStrong documentation skills and ability to write clear technical procedures and findings. \nAbility to acknowledge knowledge gaps, research unfamiliar technologies, learn quickly, and apply new knowledge safely in production environments. \nStrong collaboration skills with security, infrastructure, service delivery, leadership, and client stakeholders. \nPreferred Qualifications\n1-2 years in a Cybersecurity role. \nExperience in an MSP, MSSP, or multi-client environment. \nPrior experience in systems administration, network engineering, infrastructure engineering, or a similarly hands-on IT role before or alongside cybersecurity responsibilities. \nExperience supporting both traditional on-premises infrastructure and cloud environments. \nFamiliarity with Intune, Microsoft Defender, Microsoft Sentinel, AppLocker, ThreatLocker, and RMM-based scripting or automation. \nExperience with Azure security and infrastructure; AWS or other cloud-platform experience is also valuable. \nExperience with Windows Server, Active Directory, virtualization platforms such as VMware/Hyper-V, firewall technologies, and network troubleshooting. \nUnderstanding of CIS benchmarks, security hardening standards, Zero Trust principles, and configuration drift monitoring. \nExperience supporting vulnerability remediation and technical aspects of vCISO or managed security programs. \nExperience with scripting or automation using technologies such as PowerShell, APIs, or RMM platforms. \nSecurity certifications such as Security+, CySA+, SC-200, SC-300, AZ-500, GCIH, GCIA, or similar are a plus. \nInfrastructure/network certifications or equivalent practical experience, such as CCNA, Microsoft infrastructure certifications, Azure Administrator, or similar, are also valuable. \nSuccess in This Role Looks Like\nSecurity incidents and technical escalations are handled quickly, accurately, calmly, and with strong technical discipline. \nThe engineer can troubleshoot across security, identity, endpoint, server, network, and cloud layers rather than relying solely on security tools or another technical team. \nAlerts and risks surfaced by the toolstack are investigated and acted on consistently. \nClient security remediation items are executed thoroughly, validated, and completed on time. \nVulnerabilities are evaluated based on actual risk and business context, a...","description_format":"text","description_chars":12805,"description_truncated":true,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Pakistan","iso":"PK","kind":"country"},{"name":"South Africa","iso":"ZA","kind":"country"},{"name":"Sri Lanka","iso":"LK","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Managed IT Services (MSP)"],"lifecycle":[{"event":"open","at":"2026-09-12T12:26:49Z"}],"visa":[],"liveness":{"score":12,"band":"cold","label":"Long shot","p_open":1,"p_active":0.424,"p_room":0.28,"age_days":78,"expected_fill_days":34,"reasons":["conf:7","win:tail","crowd:"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/gxait-security-engineer","json_url":"https://alion.io/job/gxait-security-engineer.json","meta":{"generated_at":"2026-11-04T07:22:48Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11544,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":674072},"rest":"https://alion.io/mcp/rest/get_company?id=674072"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgxait-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgxait-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgxait-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/gxait-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgxait-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":819609}},{"tool":"search_jobs","arguments":{"company":"gxait.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":819609},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}