This working leadership role involves cybersecurity design, implementation, and maintenance, aligning with business initiatives. The manager leads a small team of engineers, building and operating controls to protect the company's technology and digital assets, and acts as an escalation point for security operations, threat remediation, and incident response. The role carries significant influence over security standardization, detection and response operations, and engineering practices.
Responsibilities
Lead, hire, and develop a team of security engineers, setting technical standards and clear expectations for their work
Lead cybersecurity engineering initiatives and implement designs that meet specific operational needs and environmental factors
Continuously assess systems, networks, and data to determine necessary defenses
Own the design and operation of core security controls across identity, endpoint, network, cloud, email, and data protection, with emphasis on the Microsoft security stack including Entra ID, Defender, Sentinel, Purview, and Intune
Own Identity and Access Management architecture and standards, including user access provisioning and deprovisioning processes, periodic access reviews, and related reporting
Run vulnerability management and patching end to end, including scanning, testing, and remediation
Negotiate ownership and service levels with infrastructure, application, and database teams
Mature detection engineering and incident response capability
Lead investigations into security breaches or intrusions
Manage the operational relationship with the managed security service provider
Create and maintain security policies, standards, and procedures aligned to the NIST Cybersecurity Framework, and keep them current as the environment changes
Embed security into delivery through pipeline controls, infrastructure as code guardrails, secrets management, and secure configuration baselines
Support regulatory and control obligations including SOX IT general controls
Develop executive reporting for key security technologies, including Key Performance Indicators and Key Risk Indicators, for the CTO, executive leadership, and the board
Manage outsourced security vendors, tooling evaluations, renewals, and a portion of the security budget, including consolidation decisions where coverage overlaps
Participate in the after-hours on-call rotation for incident response
Other duties as assigned
Requirements
Bachelor’s degree related to Computer Science, Business, or Information Systems preferred, or equivalent experience
Eight or more years in security engineering or security operations, including at least two years leading engineers as a manager or technical lead
Millions of jobs, with real people getting hired every day
200,000+
New jobs added daily
7,000,000+
Verified job listings
1,000,000+
Tailored applications submitted
Expertise in incident response, security operations, SIEM management, and security policy creation
Depth in cloud security on Azure, including identity and access management, network controls, and native security tooling
Practical knowledge of vulnerability and patch management at enterprise scale, with the ability to drive accountability across teams outside of direct reporting lines
Experience analyzing and documenting cybersecurity solutions and mapping them to business requirements
Familiarity with NIST and CIS frameworks and experience supporting audits or regulatory examinations
Scripting and automation ability in PowerShell, Python, or similar, with enough fluency in CI/CD and infrastructure as code to review the team’s work
Working knowledge across IAM, SIEM, firewalls and proxies, encryption, IDS and IPS, MFA, MDM, Windows Server and Linux, networking, and virtualization
Ability to set and change priorities amongst multiple competing constituencies
Strong written and verbal communication, including the ability to explain risk and tradeoffs to non-technical stakeholders
Nice to have:
CISSP, CISM, CCSP, GIAC, or Azure security specialty certifications
Experience in financial services, mortgage, or another regulated industry
Experience with Fortinet, SASE, or zero trust network access deployments
Exposure to securing AI and machine learning workloads
Experience standing up or maturing a security program rather than operating an established one
Benefits
Discretionary corporate bonus program
Multiple health plans
STD and LTD options
Company-sponsored life insurance
Fitness reimbursement
Paid parental leave
Volunteer time
Paid Time Off
ESPP
401(k) matching
About the Company
Redwood Trust, Inc. is a specialty finance company focused on investing in mortgage-related assets and engaging in residential and commercial mortgage banking activities. Its employees are a team of disciplined, dedicated, and talented professionals who value everyone's contribution and actively solicit feedback at all levels within the organization.
