{"id":3778415,"url":"https://alion.io/job/step2-it-security-specialist","title":"IT Security Specialist","company":{"id":2782549,"name":"Step2","domain":"step2.com","url":"https://alion.io/company/step2-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"ADP","truth_index":{"grade":"B","score":75,"open_postings":3,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-07T05:47:08Z"}},"role":"Support","role_family":"Support","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Streetsboro, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"CWE","optional":false},{"name":"Grafana","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"NIST CSF","optional":false},{"name":"OneDrive","optional":false},{"name":"Oracle ERP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Snowflake","optional":false},{"name":"SQL","optional":false},{"name":"VPN","optional":false}],"status":"live","first_seen_at":"2026-10-30T00:24:00Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-07T07:09:25Z","board_verified":true,"closed_at":null,"days_open":8,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":8},"description":"Job Summary:\nStep2 is looking for a security leader who thinks big picture and is also an expert at the keyboard. You will set security strategy, stay ahead of fast-changing threats (especially new attack methods and vulnerabilities that come with AI), and do the hands-on work to protect our users, systems, data and sites. You will own our security program end to end: strategy, tools, vendors, training and incident response. We want someone excited by the challenge of protecting Step2 as AI makes attacks faster, cheaper and harder to spot: someone who questions whether yesterday's tools still fit, learns fast, and designs new defenses where needed. This is not a role for someone looking to re-implement a familiar legacy stack.\nJob Duties:\nStrategy and threat intelligence: Track emerging threats, including AI-enabled phishing, deepfake and social-engineering attacks, prompt injection, data leakage through AI tools, and vulnerabilities in AI agents and integrations. Turn that into a security and business continuity strategy, with a tactical roadmap that stays current, and brief leadership on risk. The goal: no malware or device loss can take Step2 down.\nAI security: Set guardrails for how employees and systems use AI tools, agents and MCP connections. Review new AI tools and vendors for data exposure and access risk.\nIncident response and risk: Own the incident response plan, playbooks and courses of action. Run tabletop exercises, lead response when incidents happen, and maintain a risk register with mitigation plans.\n Business continuity: Build and test the continuity plan so malware, ransomware or device loss cannot stop the business. Includes fast device rebuilds, recovery of OneDrive and Microsoft 365 data (versioning, retention and backup), and regular recovery drills.\nHands-on security operations: Set and verify security controls: MFA, conditional access and privileged accounts in Entra ID; Microsoft 365 security settings; vulnerability management; firewall, VPN and segmentation rules, including plant networks; access reviews for employees and contractors. The Senior Manager, IT Infrastructure & Operations administers these platforms; this role defines and checks the controls.\nEndpoint security and disposable devices: Own the security strategy for employee laptops and mobile devices. Treat every device as disposable: work lives in OneDrive and Microsoft 365, so any device can be wiped and replaced without losing data. Run remote scans, keep a live device and software inventory, find installed threats and unapproved software, remove malware, and isolate or wipe compromised devices remotely.\n Secure development (DevSecOps): Work with the software development team to design and enable CI/CD pipelines that include static (SAST) and dynamic (DAST) code analysis, plus dependency and secrets scanning. Cover industry-standard vulnerability classes such as the OWASP Top 10 and CWE Top 25, and help developers fix findings.\n Vendors and tools: Select, implement and manage security vendors and monitoring tools (EDR, SIEM/MDR, email security, vulnerability scanning). Manage contracts, performance and budget.\n Security telemetry and reporting: Consolidate security telemetry and logs into Snowflake for analysis. Build dashboards and alerting (e.g. Grafana) that show risk, trends and program performance.\n Third-party risk: Evaluate existing, proposed and new vendors against Step2's security compliance thresholds before and after onboarding. Apply the right access controls to each vendor (least privilege, time-limited access, MFA) and reassess them on a regular schedule.\nPolicy and compliance: Keep security policies and standards current. Support audits, cyber insurance requirements and customer or retailer security questionnaires.\nSecurity awareness program: Take over and run our KnowBe4 employee training and phishing simulation program. Measure results, tailor content to our real threats and roles, and recommend how the program should evolve.\n Physical site security: Own building access control (badges, door systems, visitor access), security monitoring and CCTV across Step2 sites. Manage the related systems and vendors, review access rights, and bring physical security events into incident response and telemetry.\nBasic Qualification Requirements:\nA forward-looking mindset: you can show how you have adapted defenses to new threats, and you evaluate modern and AI-driven security tools on their merits rather than defaulting to what you used before.\n7+ years in IT security, with both strategic and hands-on technical responsibility.\nProven record of taking initiative: building or substantially improving a security program, not just maintaining one.\nCurrent knowledge of AI-related threats and controls, and a habit of keeping up with the threat landscape.\nDeep hands-on skill with Microsoft 365 security, Entra ID, EDR, SIEM or log tools, vulnerability scanning, firewalls and VPN.\nComprehensive experience with modern endpoint security strategy and management (e.g. Microsoft Intune and Defender for Endpoint): remote scanning, device and software inventory, threat and malware detection and removal, remote isolation and wipe. This is security-focused endpoint work, not general infrastructure.\nExperience running a security operations center (SOC), either internal or outsourced (MSSP/MDR), including setting escalation rules, SLAs and performance reviews. Experience selecting and managing security vendors.\nExperience writing and running incident response plans and tabletop exercises.\nExperience building and testing business continuity and ransomware recovery plans.\nExperience running a security awareness program (KnowBe4 or similar).\nWorking knowledge of a security framework such as NIST CSF or CIS Controls.\nClear communicator who can explain risk to leadership and train non-technical staff.\nCertifications preferred: CISSP, CISM, Security+, CySA+, or Microsoft SC-200/SC-300.\nAdditional Qualifications:\nExperience securing manufacturing or OT/plant networks.\nSQL and scripting (PowerShell, Python) to automate checks and analyze telemetry; Snowflake or Grafana experience.\nExperience with Oracle E-Business Suite or Snowflake access controls.\nAI security frameworks such as OWASP Top 10 for LLM Applications or NIST AI RMF.\nWork Environment/Physical Demand:\nHybrid; based in Streetsboro, OH. Office, plant and warehouse environments, with travel between Step2 sites for physical security and incidents. Standard business hours, with flexibility to be reasonably available and respond quickly to critical outages or incidents that stop business operations, especially during peak selling seasons.\nFLSA Status:\nExempt\nWhat are the perks?\nParental Leave\n401k with Employer Match\nCompany Paid Life & Disability Insurance \nAdoption Assistance \nMedical, Dental and Vision \nPremium FREE Medical Plan Option\nEmployee Discount \n10 Paid Holidays \nAdvancement Opportunities\nJoin our family!\nAll qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, or national origin.\n#LI-Hybrid","description_format":"text","description_chars":7148,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Parental leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Consumer Goods","Toys, Games & Puzzles","Outdoor & Camping Gear"],"lifecycle":[{"event":"open","at":"2026-11-05T00:04:31Z"}],"visa":[],"liveness":{"score":85,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.85,"p_room":1,"age_days":8,"expected_fill_days":29,"reasons":["conf:2","win:early"],"computed_at":"2026-11-07T05:47:08Z"},"pay":null,"html_url":"https://alion.io/job/step2-it-security-specialist","json_url":"https://alion.io/job/step2-it-security-specialist.json","meta":{"generated_at":"2026-11-07T09:25:53Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7324,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2782549},"rest":"https://alion.io/mcp/rest/get_company?id=2782549"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fstep2-it-security-specialist"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fstep2-it-security-specialist"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fstep2-it-security-specialist"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/step2-it-security-specialist\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fstep2-it-security-specialist"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3778415}},{"tool":"search_jobs","arguments":{"company":"step2.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3778415},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}