{"id":2199670,"url":"https://alion.io/job/hillpointe-cybersecurity-engineer","title":"Cybersecurity Engineer","company":{"id":678462,"name":"Hillpointe","domain":"hillpointe.com","url":"https://alion.io/company/hillpointe","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":79,"open_postings":17,"ghost_share":0,"stale_share":0.647,"repost_share":0,"time_to_fill_p50_days":77,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Winter Park, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":88000,"max_usd":170000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":425},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Commander.js","optional":false},{"name":"Configuration Management","optional":false},{"name":"ISO 27001","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Zero Trust","optional":false},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true}],"status":"live","first_seen_at":"2026-10-09T19:32:33Z","employer_posted_date":"2026-10-09","last_verified_at":"2026-10-16T06:24:40Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"WHY HILLPOINTE? Hillpointe is a fully integrated real estate development and investment management firm focused on developing market-rate workforce housing across the Sun Belt. Ranked at the top of NMHC's list of Builders and Developers, our team ensures best-in-class execution.\nBuilt on its long and proven track record of real estate development, the firm’s investment approach is centered around its in-house general contracting expertise, enabling direct control of cost and delivery timeframe. For each project, Hillpointe directly controls land acquisition, land development, construction, procurement of building materials, asset management, and capital markets. This is more than just a job - it's a career-defining opportunity! At Hillpointe, you'll be part of a dynamic, innovative team that has tangible impacts on day-to-day operations and contributes directly to overall success.\nCybersecurity Engineer \nThe Cybersecurity Engineer owns the day-to-day security operations of the organization's fully cloud-based technology environment. This is the company's dedicated security role, and it operates with a high degree of independence: the incumbent drafts and sets the approved operational security agenda, oversees external MDR, drives vulnerability and access remediation with system owners, and carries the organization through external audit. Because the scope is broad by design, the role is structured to scale through leverage - directing managed security service providers and specialist vendors for around-the-clock monitoring and surge capacity, while retaining ownership of strategy, configuration, escalation, and outcomes in-house. \nThe successful candidate is equally comfortable investigating an alert at the console and explaining residual risk to business leadership. This is a high-visibility role with a direct line to decisions about how the organization protects its data, its residents' information, and its capital. \nKey Responsibilities:\nThreat Detection & Incident Response \nOwn detection and response across cloud identity, endpoint, email, and cloud infrastructure, including triage, containment, eradication, and recovery \nServe as primary incident responder and incident commander for security events, coordinating internal stakeholders, managed service providers, and outside counsel or forensics as required \nMaintain and exercise the incident response plan, including tabletop exercises and post-incident reviews that produce tracked corrective actions \nDevelop and tune detection rules, alert logic, and automated response playbooks to reduce mean time to detect and mean time to respond \nBuild and maintain runbooks for recurring incident types so that response is repeatable and not dependent on a single individual \n\nSecurity Monitoring, SIEM & Reporting \nAdminister the security information and event management (SIEM) platform, including data source onboarding, log ingestion health, normalization, and retention configuration \nManage ingestion cost and data tiering to keep monitoring coverage aligned with budget \nBuild and maintain dashboards, analytics rules, and workbooks that provide operational visibility into the security posture of the cloud environment \nProduce recurring security reporting for IT leadership and executive stakeholders, translating technical findings into business risk and clear recommendations \nDefine and track security metrics - detection coverage, alert volume and disposition, patch and remediation timeliness, phishing susceptibility, and audit readiness \nVulnerability & Configuration Management \nRun the vulnerability management lifecycle across endpoints, servers, cloud workloads, and third-party platforms: discovery, assessment, risk-based prioritization, remediation tracking, and verification \nPartner with system and application owners to drive remediation to closure, escalating where service-level targets are at risk \nAssess and harden security configuration baselines against recognized benchmarks, and monitor for configuration drift \nCoordinate external penetration testing and vulnerability assessments, and manage the resulting findings through to resolution \nMaintain the risk register and formal exception process for accepted risks, with documented compensating controls and review dates \nIdentity & Privileged Access Governance \nAdminister privileged identity and privileged access management, including just-in-time elevation, approval workflows, activation justification, and time-bound role assignment \nConduct recurring privileged access reviews and audits, validating that standing administrative access is eliminated or justified and that every elevation is attributable \nOwn access review and recertification cycles across the cloud tenant and integrated business platforms, coordinating with business owners as reviewers \nReview and strengthen conditional access, multifactor authentication, and device compliance policies, including break-glass account controls and their periodic testing \nMonitor for identity-based threats - token theft, consent phishing, risky sign-ins, legacy authentication, and over-permissioned service principals and application registrations \nCloud & DevOps Security \nProvide security oversight of the organization's cloud productivity tenant and cloud infrastructure platform, including tenant-level security configuration and posture management \nEmbed security into development and automation pipelines: secrets management, dependency and container scanning, infrastructure-as-code review, and pipeline identity and permission hygiene \nReview and advise on cloud architecture changes, network segmentation, and secure-by-default configuration before deployment rather than after \nAdminister cloud-delivered secure access and secure web gateway capabilities for private application access, internet egress filtering, and conditional network controls \nGovern third-party application consent, API permissions, and integration security across the cloud tenant \nData Protection, Compliance & eDiscovery \nServe as the primary owner for the annual SOC 2 audit: control mapping, evidence collection, gap remediation, auditor liaison, and management of the readiness timeline \nMaintain the security control framework and supporting policy set, keeping documentation current and demonstrably operating \nAdminister the data governance and compliance platform, including data loss prevention policies, sensitivity labeling, retention, and insider risk controls \nConduct eDiscovery searches, legal holds, exports, and collection activities in support of legal, human resources, and compliance requests, maintaining defensible chain of custody \nSupport security questionnaires, investor and lender due-diligence requests, and cyber insurance renewals with accurate control attestations \nTrack applicable regulatory and contractual obligations relating to personal information and advise the business on required controls \nSecurity Awareness & Human Risk \nOwn the security awareness program end to end: content selection, campaign calendar, assignment, completion tracking, and effectiveness measurement \nDesign and administer simulated phishing campaigns, including scenario selection, difficulty progression, targeting, and results analysis \nDeliver targeted follow-up training and coaching for repeat-susceptible users, favoring constructive reinforcement over punitive measures \nProvide role-specific training for higher-risk functions such as finance, accounting, and executive support, with emphasis on payment fraud and business email compromise \nContribute security content to new-hire onboarding in partnership with Human Resources and Training \nVendor & Managed Service Oversight \nManage outsourced security functions and managed security service providers, including scope definition, service-level expectations, escalation paths, and performance review \nValidate provider work rather than accepting it at face value: review alert dispositions, challenge false-negative and false-positive patterns, and audit coverage gaps \nEvaluate, pilot, and recommend security tooling, with attention to consolidation and total cost of ownership rather than point-solution accumulation \nOwn security vendor relationships, contract renewals, and license true-ups in coordination with IT leadership \nConduct third-party and vendor security risk assessments for new platforms prior to adoption \nQualifications:\nRequired: \n4+ years of hands-on experience in cybersecurity operations, security engineering, or a security-focused systems administration role, in a predominantly cloud environment \nDemonstrated experience with security monitoring and SIEM platforms, including detection tuning and investigation of real alerts through to disposition \nPractical experience with endpoint detection and response and cloud-native security tooling across identity, endpoint, email, and cloud workloads \nWorking knowledge of cloud identity security, including conditional access, multifactor authentication, and privileged access management concepts \nExperience running a vulnerability management program, including prioritization and driving remediation through other teams \nDirect participation in a recognized audit or compliance program such as SOC 2, ISO 27001, or NIST Cybersecurity Framework, including evidence collection \nAbility to lead an incident calmly under pressure and to document what happened clearly afterward \nStrong written communication: policies, runbooks, findings, and executive-level summaries \nSound judgment about what to escalate and what to handle independently, with the discretion the role requires \nPreferred: \nExperience administering a cloud data governance and compliance platform, including data loss prevention and eDiscovery \nExperience integrating security controls into CI/CD pipelines and infrastructure-as-code workflows \nExperience managing or holding a managed security service provider accountable to service levels \nScripting or automation capability for reporting, evidence collection, and repetitive response tasks \nExperience administering a security awareness and simulated phishing platform \nFamiliarity with secure access service edge or zero-trust network access technologies \nExposure to real estate, construction, property management, or another multi-site operating environment \nRelevant certifications such as CISSP, CISM, GIAC, CCSP, or vendor-specific cloud security certifications; certification is valued but does not substitute for demonstrated hands-on capability \nWork Environment: \nThis is a fully cloud-based environment. Incumbents primarily work in an office setting with occasional travel between office locations required. The role requires availability outside standard business hours for security incidents, and as the primary on-call escalation. Occasional extended hours may be needed to support audit deadlines, remediation windows, or critical incidents.","description_format":"text","description_chars":10946,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Property Development","Residential Real Estate"],"lifecycle":[{"event":"open","at":"2026-10-09T20:54:21Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.602,"p_room":1,"age_days":6,"expected_fill_days":77,"reasons":["conf:3","stale_co","win:early"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/hillpointe-cybersecurity-engineer","json_url":"https://alion.io/job/hillpointe-cybersecurity-engineer.json","meta":{"generated_at":"2026-10-16T10:37:20Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9046,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":678462},"rest":"https://alion.io/mcp/rest/get_company?id=678462"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhillpointe-cybersecurity-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhillpointe-cybersecurity-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhillpointe-cybersecurity-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/hillpointe-cybersecurity-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhillpointe-cybersecurity-engineer"}]}