Security Engineer

The role

BD Emerson is hiring a security engineer to design, build, and test the security controls our clients rely on to protect their systems and pass their audits. This is a client-facing engineering role. You will work hands-on in client environments across Microsoft 365, Azure, AWS, and Google Cloud, alongside our compliance, privacy, and application security teams.

Our clients are regulated companies: software providers selling to enterprises, healthcare organizations, financial services firms, and defense contractors. They need controls that work in production and evidence that holds up when an auditor, an assessor, or a customer asks for it. In this role, you make both true.

This is a hybrid role based in Richmond, Virginia. You will work from our Richmond office and from client sites in the area part of each week, with occasional travel to clients elsewhere in the United States.

What you will do

• Harden identity and access: configure Microsoft Entra ID, Okta, or Google Workspace for single sign-on, phishing-resistant MFA, conditional access, and privileged access management
• Secure AWS, Azure, and Google Cloud environments, including network segmentation, encryption and key management, centralized logging, and least-privilege IAM, written as infrastructure as code wherever the client allows it
• Deploy and tune security tooling such as EDR, SIEM, vulnerability scanning, email security, and data loss prevention, with Microsoft Defender, Sentinel, Purview, and comparable platforms
• Build and configure CMMC Level 2 environments in Microsoft 365 GCC High and Azure Government, and map each configuration to the NIST SP 800-171 requirement it satisfies
• Implement the technical controls behind client SOC 2, ISO 27001, HIPAA, and CMMC programs, and automate the evidence collection that auditors and assessors request
• Run vulnerability management end to end: scan, prioritize by exploitability and business impact, drive remediation with client teams, and verify each fix
• Support incident response engagements with log analysis, containment, and recovery work
• Write runbooks, architecture diagrams, and remediation guidance that a client's own IT team can follow after the engagement ends
• Explain technical findings and trade-offs to client executives in plain language

How we expect you to use AI

We expect the people on our teams to use AI assistants such as Claude and ChatGPT every day: to draft scripts, policies, and runbooks, to work through logs and configurations, and to move faster across research and delivery. We also expect you to verify what these tools produce before it touches a client environment. An untested configuration from an AI assistant is a liability, and you own the result either way. Experience securing AI systems and the data that feeds them is a plus.

Requirements

• Bachelor's degree in computer science, information security, or a related field, or equivalent work experience
• 4+ years in security engineering, cloud engineering, or systems administration with a security focus, including at least 2 years working directly in production cloud or Microsoft 365 environments
• Hands-on experience with Microsoft Entra ID, Intune, Defender, and Purview, or with an equivalent stack such as Okta, CrowdStrike, and Google Workspace
• Working knowledge of AWS, Azure, or Google Cloud at the level of designing IAM, network, and logging controls
• Scripting in PowerShell or Python, and experience with infrastructure as code such as Terraform or Bicep
• Familiarity with the frameworks our clients answer to, including SOC 2, ISO 27001, NIST SP 800-171 and CMMC, and HIPAA, and with how a technical control produces audit evidence
• Client-facing experience and the ability to explain a risk and its fix to engineers and executives alike
• Clear writing: runbooks, findings, and remediation steps that a reader can act on without a follow-up call
• Fluency with AI assistants (for example, Claude and ChatGPT) as everyday working tools
• Ability to work from our Richmond office and client sites in the Richmond area part of each week, and to travel occasionally

Preferred

• Current certifications such as CISSP, CCSP, Microsoft SC-200 or AZ-500, AWS Certified Security Specialty, GIAC (GCIH, GCED, or GPEN), or CompTIA Security+ and CySA+
• Experience building or operating a Microsoft 365 GCC High environment
• Penetration testing or application security experience
• Experience in a regulated industry such as healthcare, financial services, or the defense industrial base

Pay and benefits

The base salary range for this role is $115,000 to $150,000 per year. Where an offer falls in that range depends on experience, skills, and certifications.

Full-time employees are eligible for medical, dental, and vision coverage, paid time off, and paid holidays.

Applications are accepted through December 18, 2026.

Work authorization

Applicants must be currently authorized to work in the United States on a full-time basis upon hire. BD Emerson will not consider candidates for this position who require sponsorship for employment visa status now or in the future (for example, H-1B status).