Principal Security Engineer at Scholastic in New York, NY

Job description

Job Description: NOTE: This role is based in New York City and encourages a minimum of two days per week in the SoHo office. Some roles or teams may require additional in-office attendance if the essential functions of the role require it. THE OPPORTUNITY The Principal Security Engineer will be part of the Scholastic Security organization and report to the Executive Director of Information Security and Compliance. This role will work closely with the CISO and the SVP of Technology Operations to proactively identify, assess, and reduce security risk across Scholastic’s network, systems, applications, and third-party ecosystem. The position is responsible for assessing information risk, identifying vulnerabilities, facilitating remediation, documenting mitigation options, monitoring remediation progress, and reporting findings and recommendations. The Principal Security Engineer will also support IT audits, risk assessments, regulatory compliance, vulnerability assessments, third-party risk management activities, and weekly project status reporting. YOUR RESPONSIBILITIES Design and implement security architecture and controls across cloud, network, endpoint, and application environments. Work closely with team members to enhance, implement, and configure scalable security technologies and improve detection and response capabilities. Lead engineering efforts to build, tune, and scale security tooling, including SIEM, EDR, vulnerability management, identity and access management, TPRM and secrets management platforms. Work closely with the SOC to review, develop, and maintain incident response playbooks. Serve as an escalation point for SOC incidents, providing technical guidance and support during investigation and response activities. Develop metrics and KPIs that demonstrate security posture, control effectiveness, and tooling consolidation progress. Automate security controls and evidence collection to support audit and compliance programs, including SOX IT General Controls, PCI DSS, SOC 2. Ensure CIS benchmark controls are applied, configurations are maintained across the enterprise, continuous monitoring is performed, and remediation plans are developed for identified gaps. Continuously improve the security framework, methodology, standards, and system of internal controls Lead and assist in security risk assessments for systems and applications Address questions from internal and external audits and examinations Develop policies, procedures, and standards that meet existing and newly developed policy and regulatory requirements, including SOX, PCI, and Privacy Research business and technical challenges and provide solution recommendations to mitigate risk and improve our security posture Perform security reviews, identify gaps in security architecture, and develop a security risk management plan Serve as a project lead within IT security projects Provide advice on project costs, design concepts, or design changes Define and document how the implementation of a new system, or interfaces between systems, impacts the security posture of the current environment Drive and deliver Enterprise security roadmap and initiatives Conduct a cybersecurity incident response tabletop exercise at least annually. Identifies opportunities to reduce risk and documents remediation options regarding acceptance or mitigation of risk scenarios Investigate security incidents and lead incident response activities, including minimizing impact, performing technical and forensic analysis, determining root cause, and assessing the extent of damage. Build tools and automation scripts that enable developers to consume security services delivered by the Security Engineering and Automation team. Monitor emerging threats, vulnerabilities, and industry best practices to inform risk decisions and security roadmap priorities. Develop metrics/KPIs to show security posture and tools consolidation Develop and maintain documentation, runbooks, and standards for sec