Information Security Engineer III

ICW Group is seeking an experienced Information Security Engineer III to help design and operationalize security for cloud, data, and AI-driven environments. In this role, you will work alongside engineering teams to embed security from initial architecture through production, while supporting vulnerability management, threat detection, and incident response across the organization.

Location and employment details

• Location: San Diego, CA (onsite)
• Job type: Full time
• Job category: IT
• Req ID: JR101654

Compensation

• Salary range: USD 121,624 - 217,710 per yearly
• This range is exclusive of fringe benefits and potential bonuses.
• Final base salary compensation is determined by factors including experience, education, and the location of the role, and considers employees performing substantially similar work.

Role summary

You will develop cybersecurity approaches and secure architectures to protect ICW Group’s infrastructure and workloads. The position includes monitoring for threats across cloud, on-prem, and SaaS environments, producing risk-focused findings, and contributing to security architecture reviews, standards, and guardrails.

Responsibilities

• Monitor cloud, on-prem, and SaaS environments for security threats using SIEM, EDR, cloud-native logging, and network telemetry.
• Support security incident response activities including investigation, containment, remediation, and post-incident analysis.
• Research and implement methods to remediate network and application security vulnerabilities.
• Lead and participate in security architecture controls reporting, compliance audits, monthly and ad-hoc statistics and trends, and risk-focused reporting including internal and 3rd party Risk Assessments.
• Produce risk-focused security findings and communicate clearly with technical and non-technical stakeholders.
• Conduct threat hunting and root-cause analysis to identify anomalous behavior, exploitation attempts, and indicators of compromise.
• Investigate potential data misuse, data exfiltration, and anomalous access patterns using logs, DLP, and monitoring tools.
• Prepare and analyze system security reports by collecting, analyzing, and summarizing data and trends, and make recommendations to improve security.
• Serve as a senior technical contributor across cloud security, including IAM, logging, monitoring, detection, and secure deployment patterns.
• Lead or contribute to vulnerability management across cloud infrastructure, applications, containers, and data platforms.
• Participate in offensive and defensive security activities including threat modeling, red team exercises, blue team detection improvements, and threat hunting.
• Support incident response investigations involving cloud misconfigurations, data exposure, and/or AI-related security events.
• Perform security architecture reviews and provide guidance to engineering teams to reduce risk while enabling business objectives.
• Implement and improve security controls that strengthen ICW’s overall security posture while supporting modern cloud and data initiatives.
• Partner with Engineering, Infrastructure, Cloud, Data, and Operations teams to embed security into system design and delivery.
• Lead security reviews for new data, analytics, and/or AI initiatives, including architecture reviews and risk assessments prior to production deployment.
• Conduct threat modeling and security design reviews for systems involving data, analytics, AI, and/or cloud services.
• Create and maintain technical security standards and guardrails related to data protection, cloud usage, and/or AI security.
• Partner with internal teams to remediate security findings and track remediation activities through closure.
• Provide security guidance that balances risk reduction with delivery speed and business priorities.
• Execute technical and process changes required to adopt, maintain, and adjust InfoSec controls as required to manage company risks and align with industry best practices.
• Act as a trusted security advisor to project teams, helping them understand risk, controls, and secure design patterns.
• Coach and mentor engineers on secure development, data handling, and cloud security best practices.
• Work closely with project management and internal stakeholders to define and implement secure, scalable solutions.
• Design and implement security controls to protect sensitive insurance data across AWS data platforms, analytics pipelines, and AI/ML workloads.
• Provide security oversight for AI and LLM use cases, including model access controls, training data protection, inference security, data leakage prevention, and misuse/abuse risk.
• Assess and mitigate risks related to AI systems and LLM usage, including prompt injection, data poisoning, third-party data sources, and emerging AI threats.
• Partner with Compliance and Governance teams to ensure data and AI controls align with NIST, NYDFS, PCI DSS, and California privacy regulations (CPRA/CCPA).
• Contribute to the development of ICW’s AI security standards, guardrails, and internal guidance as AI adoption expands.
• Support Third-Party Risk (TPR) evaluations for AI vendors, SaaS platforms, data providers, and analytics tools that process or access ICW data.
• Evaluate and onboard security tools and vendors related to data protection, cloud security posture, AI governance, and detection.
• Assist with strategic initiatives for short and long-term plans to identify and reduce the attack surface across applications and systems.
• Ensure security is embedded into systems from design through production.

Requirements

• Education: Bachelor's Degree in Engineering, Cybersecurity, Networking, or Computer Science related discipline
• Experience: Minimum 8 years of experience working in a security engineering related role designing secure networks, systems and application architectures or equivalent combination of education and experience required
• Cloud: Minimum 3-5 years of experience in AWS Cloud Security services preferred
• Direct experience using IDS/IPS, firewalls, SIEM, antivirus software, network packet analyzers, content filtering, malware analysis, and forensics tools to detect intrusions
• Experience in a cyber security role requiring knowledge of data analysis, risk assessment, risk mitigation, investigation methods, incident management concepts and practices, and policy and procedure development
• Experience with AWS services including AWS Identity & Access Management, AWS Organizations, AWS Security HuB, Guard Duty, CloudTrail, AWS CloudTrail

Technologies

• SIEM, EDR, cloud-native logging, network telemetry, DLP
• IAM, intrusion detection & prevention systems (IDS/IPS), firewalls, antivirus software
• Network packet analyzers, content filtering, malware analysis, forensics tools
• AWS Identity & Access Management, AWS Organizations, AWS Security HuB, Guard Duty, CloudTrail
• NIST, NYDFS, PCI DSS, CPRA, CCPA

Benefits

• Competitive benefits package with generous medical, dental, and vision plans
• 401K retirement plans and company match
• Bonus potential for all positions
• Paid Time Off
• Paid holidays throughout the calendar year
• Learning support: support for continued learning, with tuition assistance described as “100%” support

Knowledge and skills

• Knowledge of risk assessment tools, technologies, and methodologies
• Knowledge of disaster recovery and computer forensic tools, technologies, and methods
• Knowledge of enterprise security platforms
• Ability to communicate network security issues to peers and management
• Ability to read and use the results of mobile code, malicious code, and anti-virus software
• Strong understanding of endpoint security solutions including File Integrity Monitoring and Data Loss Prevention
• Demonstrated experience as a lead engineer in the design, implementation and support in an enterprise IT environment
• Ability to combine disparate skills to craft solutions and solve complex operational problems, including hypothesizing on root cause and testing solutions
• Ability to read, write, and speak English effectively
• Ability to communicate and present technical information to non-technical audiences
• Ability to cross train and share information with team members

Work environment

• Office environment with frequent use of a computer, telephone, copier, and other standard office equipment

Physical requirements

• Office environment with no specific or unusual physical or environmental demands; employees regularly sit, walk, stand, talk, and hear
• Required to reach with hands and arms; stoop, kneel, crouch, or crawl
• Occasionally lift and/or move up to 30 pounds
• Visual acuity required; capable of operating and viewing computers and other electronic devices for extended periods of time