{"id":2451782,"url":"https://alion.io/job/scholastic-principal-security-engineer","title":"Principal Security Engineer","company":{"id":94789,"name":"Scholastic","domain":"scholastic.com","url":"https://alion.io/company/scholastic-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":132000,"max_usd":279000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":349},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"C#","optional":false},{"name":"C++","optional":false},{"name":"CIS Benchmarks","optional":false},{"name":"IAM","optional":false},{"name":"JavaScript","optional":false},{"name":"NIST CSF","optional":false},{"name":"PCI DSS","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-10-07T00:00:00Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-10-13T14:56:56Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"Job Description:\nNOTE: This role is based in New York City and encourages a minimum of two days per week in the SoHo office. Some roles or teams may require additional in-office attendance if the essential functions of the role require it.\nTHE OPPORTUNITY\nThe Principal Security Engineer will be part of the Scholastic Security organization and report to the Executive Director of Information Security and Compliance. This role will work closely with the CISO and the SVP of Technology Operations to proactively identify, assess, and reduce security risk across Scholastic’s network, systems, applications, and third-party ecosystem. The position is responsible for assessing information risk, identifying vulnerabilities, facilitating remediation, documenting mitigation options, monitoring remediation progress, and reporting findings and recommendations. The Principal Security Engineer will also support IT audits, risk assessments, regulatory compliance, vulnerability assessments, third-party risk management activities, and weekly project status reporting.\nYOUR RESPONSIBILITIES\nDesign and implement security architecture and controls across cloud, network, endpoint, and application environments.\nWork closely with team members to enhance, implement, and configure scalable security technologies and improve detection and response capabilities.\nLead engineering efforts to build, tune, and scale security tooling, including SIEM, EDR, vulnerability management, identity and access management, TPRM and secrets management platforms.\nWork closely with the SOC to review, develop, and maintain incident response playbooks.\nServe as an escalation point for SOC incidents, providing technical guidance and support during investigation and response activities.\nDevelop metrics and KPIs that demonstrate security posture, control effectiveness, and tooling consolidationprogress.\nAutomate security controls and evidence collection to support audit and compliance programs, including SOX IT General Controls, PCI DSS, SOC 2.\nEnsure CIS benchmark controls are applied, configurations are maintained across the enterprise, continuous monitoring is performed, and remediation plans are developed for identified gaps.\nContinuously improve the security framework, methodology, standards, and system of internal controls\nLead and assist in security risk assessments for systems and applications\nAddress questions from internal and external audits and examinations \nDevelop policies, procedures, and standards that meet existing and newly developed policy and regulatory requirements, including SOX, PCI, and Privacy \nResearch business and technical challenges and provide solution recommendations to mitigate risk and improve our security posture\nPerform security reviews, identify gaps in security architecture, and develop a security risk management plan\nServe as a project lead within IT security projects\nProvide advice on project costs, design concepts, or design changes\nDefine and document how the implementation of a new system, or interfaces between systems, impacts the security posture of the current environment\nDrive and deliver Enterprise security roadmap and initiatives\nConduct a cybersecurity incident response tabletop exercise at least annually.\nIdentifies opportunities to reduce risk and documents remediation options regarding acceptance or mitigation of risk scenarios\nInvestigate security incidents and lead incident response activities, including minimizing impact, performing technical and forensic analysis, determining root cause, and assessing the extent of damage.\nBuild tools and automation scripts that enable developers to consume security services delivered by the Security Engineering and Automation team.\nMonitor emerging threats, vulnerabilities, and industry best practices to inform risk decisions and security roadmap priorities.\nDevelop metrics/KPIs to show security posture and tools consolidation\nDevelop and maintain documentation, runbooks, and standards for security engineering practices.\nTrack emerging threats, vulnerabilities, and industry best practices, and translate relevant developments into actionable recommendations for leadership.\nMentor and provide technical leadership to other security analysts, engineers, and contribute to hiring and skill development.\n About Scholastic\nFor more than 100 years, Scholastic Corporation (NASDAQ: SCHL) has been meeting children where they are - at school, at home and in their communities - by creating quality content and experiences, all beginning with literacy. Scholastic delivers stories, characters, and learning moments that empower all kids to become lifelong readers and learners through bestselling children’s books, literacy- and knowledge-building resources for schools including classroom magazines, and award-winning, entertaining children's media. As the world's largest publisher and distributor of children's books through school-based book clubs and book fairs, classroom libraries, school and public libraries, retail, and online, and with a global reach into more than 135 countries, Scholastic encourages the personal and intellectual growth of all children, while nurturing a lifelong relationship with reading, themselves, and the world around them. Learn more at www.scholastic.com.\nSome benefits that we offer:\nFull suite of health and wellness benefits (including a $0 deductible Medical Plan)\nRetirement Savings Plan 401(k) with options for both Roth and Traditional Contributions\nTuition-Free programs for undergraduate and graduate degrees\nGenerous Parental Leave Program\nEmployee Stock Purchase Plan (ESPP) with opportunity for discounted stock at a 15% discount\nThank you for your consideration in choosing Scholastic.\nQualifications\nHOW YOU CAN FIT\nA bachelor's degree in information systems, engineering, or equivalent work experience\nCandidates with the following certifications are preferred: ISC2, SANS, ISACA, or other recognized security professional credentialing organizations\nMinimum 10+ years of experience in designing and implementing security solutions, including IAM, EDR, MDM, SIEM, KMS, and PAM\n5+ years of experience in a Security Operations Center or Continuous Monitoring role\n5+ years working and supporting Incident Response functions\nHands-on experience with software development languages and technologies, including Java, C#, C++, JavaScript, and HTML.\nStrong hands-on infrastructure security skills, including IDS/IPS, firewalls, SIEM, server and operating system hardening, malware detection, physical security, and encryption for data in transit and at rest across file systems, databases, and other data persistence mechanisms.\nExperience managing application security testing tools, including SAST, DAST, and open-source vulnerability scanning.\nExperience implementing SOX, PCI, NIST CSF, CIS Controls, and SANS Controls is required.\nExcellent written and verbal communication skills - including the ability to effectively communicate security- and risk-related concepts to technical and non-technical audiences - and strong interpersonal and collaborative skills\nAbility to operate with minimal supervision as a self-starter who can identify and resolve problems, manage multiple priorities, deliver results, and meet deadlines.\nKnowledge of tactics, techniques, and procedures that are leveraged to perform recon, which can be used to gain persistence, move laterally, or exfiltrate data\nIn-depth knowledge and understanding of information risk concepts and principles as a means of relating business needs to security controls, excellent understanding of information security concepts, protocols, industry best practices, and strategies\nAbility to work in a highly fast-paced environment with high expectations\nTime Type:\nFull timeJob Type:\nRegularJob Family Group:\nInformation TechnologyLocation Region/State:\nNew YorkCompensation Range:\nAnnual Salary: 165,000.00 - 185,000.00EEO Statement:\nScholastic is an Equal Opportunity Employer. Our policy is clear: there shall be no discrimination on the basis of race, religion, color, sex, pregnancy, national origin, marital status, sexual orientation, gender identity or expression, age, non-disqualifying physical or mental disability, or status as a disabled veteran or Vietnam veteran. Those factors shall not influence the determination of qualifications for a job or other opportunity within the company. Further, all personnel actions (such as compensation, tuition aid, benefits, transfers, promotions, and dismissals, company-sponsored training, social and recreational programs) shall be administered without discrimination.\nEEO is the Law Poster\nEEO Scholastic Policy Statement\nPay Transparency Provision","description_format":"text","description_chars":8715,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Parental leave","Retirement plans"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":[],"lifecycle":[{"event":"open","at":"2026-10-13T14:56:56Z"}],"visa":[],"liveness":{"score":85,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.846,"p_room":1,"age_days":6,"expected_fill_days":23,"reasons":["conf:3","win:early"],"computed_at":"2026-10-13T18:36:54Z"},"pay":null,"html_url":"https://alion.io/job/scholastic-principal-security-engineer","json_url":"https://alion.io/job/scholastic-principal-security-engineer.json","meta":{"generated_at":"2026-10-13T18:36:54Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":28532,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":94789},"rest":"https://alion.io/mcp/rest/get_company?id=94789"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fscholastic-principal-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fscholastic-principal-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fscholastic-principal-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/scholastic-principal-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fscholastic-principal-security-engineer"}]}