7+ years in IT security, with at least 3 years in a security engineering role.
Hands-on experience with an MDR or SOC provider, including alert tuning and playbook development.
Experience managing a data security or governance platform.
Strong knowledge of Microsoft 365 security tools (Entra ID, Defender, Purview, Intune).
Familiarity with Cisco firewalls, VPN, and network segmentation.
Proven incident response leadership from detection to post-incident review.
Experience as a control owner for SOC 2 or similar audits.
Responsibilities
Direct the firm's MDR provider, tuning alerts and maintaining playbooks.
Lead incident response efforts, coordinating with IT leadership and external parties.
Oversee vulnerability and patch management through the MDR service.
Administer the data security platform, managing permissions and data classification.
Set and enforce least-privilege standards across Microsoft 365 and file systems.
Decide on escalated security requests and coach the service desk on triage.
Define security requirements for generative AI tools and ensure compliance.
Benefits
Opportunity to lead security practices in a dynamic environment.
Collaborative work with IT leadership and external partners.
Access to cutting-edge security tools and platforms.
Professional development opportunities in cybersecurity and compliance.
Flexible work arrangements across multiple offices.
Full Job Description
Bennett Thrasher is looking for Senior Cybersecurity Engineer to own day-to-day security, including the safe use of AI tools, for multiple offices. You will be the firm's lead security practitioner - directing our managed detection and response (MDR) partner, running our data security platform, setting the security requirements and guardrails for our AI tools, and making the daily access and risk decisions that protect client financial data.
You will work alongside our Microsoft 365 Administrator, who implements and operates the Microsoft security and compliance configuration (Purview, Defender, Entra ID, and Intune). Additionally, you'll define the requirements, approve exceptions, and verify the results; the administrator builds and runs the configuration.
WHAT YOU'll DO:
Detection and response
Direct the firm's MDR provider: tune alerts, build and maintain playbooks, and own integrations with firm systems.
Lead incident response, coordinating the MDR provider, IT leadership, and outside parties.
Oversee vulnerability and patch management delivered through the MDR service.
Review detections and response actions with the MDR provider and the Microsoft 365 Administrator, who maintains the endpoint protection configuration.
Data security
Administer the DSPM platform: permissions, data classification, alerting, and remediation of overexposed data.
Set least-privilege standards across Microsoft 365 and firm file systems, and verify they are enforced.
Set data loss prevention, retention, and sensitivity-labeling requirements with Compliance. The Microsoft 365 Administrator implements them in Purview, and you review and approve the results.
Daily security operations
Decide on escalated security requests: access exceptions, phishing reports that go beyond first-line triage, and security reviews of new software and vendors.
Write and maintain the runbooks the service desk uses for first-line security triage, and coach the desk to resolve routine requests without escalation.
Advise the service desk and systems team on security questions and escalations.
AI security
Define the security requirements for the firm's generative AI tools, including Microsoft Copilot (data loss prevention, access controls, and usage monitoring), and verify they are in place. The Microsoft 365 Administrator configures the Microsoft-side controls.
Own the AI guardrail capabilities outside Microsoft 365, including our secure access platform, and help evaluate any additional AI guardrail software.
Turn the firm's AI usage policy into enforceable controls, working with the owners of AI governance.
Vendor and network oversight
Serve as the primary contact for security vendors, and manage their performance, renewals, and roadmaps.
Set security requirements for the Cisco network (firewalls, segmentation, VPN, wireless) and review changes made by the managed network partner.
Compliance
Serve as control owner for assigned security controls in the firm's annual SOC 2 Type II audit: maintain control effectiveness throughout the audit period, provide evidence to auditors, and remediate any exceptions identified.
Review and approve changes to security controls made by others, keeping configuration and approval separate for audit purposes.
Develop, maintain, and regularly review security policies, procedures, and runbooks so they reflect current threats, technologies, and compliance requirements.
WHAT YOU'll BRING:
7+ years in IT security, including at least 3 in a security engineering role.
Hands-on experience working with an MDR or SOC provider: alert tuning, playbook development, and EDR or SIEM integrations.
Experience running a data security or data governance platform.
Solid Microsoft 365 security knowledge (Entra ID, Conditional Access, Defender, Purview, and Intune), enough to design policy, set requirements, and review an administrator's work.
Working knowledge of Cisco firewalls, VPN, and network segmentation, enough to set requirements and review a partner's work.
Experience leading incident response from detection through post-incident review.
Experience supporting SOC 2 or a comparable audit as a control owner.
Experience managing security vendors and service providers, including holding them accountable to contracted scope, deliverables, and service level agreements (SLAs).
Clear communication with non-technical staff and firm leadership, and sound judgment on risk trade-offs.
Nice to have:
CISSP, CISM, or a GIAC certification.
Familiarity with tools and controls for securing generative AI, including Microsoft Purview (DLP, sensitivity labels, DSPM for AI), Defender for Cloud Apps and Entra Conditional Access, and awareness of AI-specific risks such as data leakage and prompt injection.
Background in accounting, professional services, or financial services.
Azure security experience.
Scripting for automation in PowerShell or Python.
CCNA as well or Network +
About Bennett Thrasher
Bennett Thrasher is a full-service certified public accounting and consulting firm located in Atlanta, Georgia. The firm provides tax, accounting, assurance, and consulting services to clients in a variety of industries, including real estate, construction, healthcare, and technology. Bennett Thrasher was founded in 1980 and has grown to become one of the largest accounting firms in the Southeast. The firm is committed to providing exceptional service to its clients and has a reputation for delivering innovative solutions to complex business problems.
