Security Engineer Attack Surface Platforms (Hybrid) at First American in Santa Ana, CA

Job description

Who We Are Join a team that puts its People First! Since 1889, First American (NYSE: FAF) has held an unwavering belief in its people. They are passionate about what they do, and we are equally passionate about fostering an environment where all feel welcome, supported, and empowered to be innovative and reach their full potential. Our inclusive, people-first culture has earned our company numerous accolades, including being named to the Fortune 100 Best Companies to Work For® list for eleven consecutive years. We have also earned awards as a best place to work for women, diversity and LGBTQ+ employees, and have been included on more than 50 regional best places to work lists. First American will always strive to be a great place to work, for all. For more information, please visit www.careers.firstam.com. What We Do The Security Engineer – Attack Surface Platforms operates and improves the organization’s cloud native application protection platform (CNAPP) and related attack surface capabilities. The role reviews and triages findings, validates risk and ownership, coordinates remediation with cloud and application teams, and maintains the quality of the platform’s policies, integrations, workflows, and reporting. It also delivers tested, incremental enhancements that help teams identify and address cloud security exposure. This role is suited to internal candidates with a security or technology foundation and an interest in developing cloud security skills. Essential Functions · Monitor CNAPP queues, dashboards, alerts, and platform health. Review new and aging findings, identify duplicates or data quality issues, and route actionable items to the appropriate cloud, platform, application, or security owner. · Triage cloud misconfigurations, vulnerabilities, exposed assets, excessive permissions, and workload or container risks. Use asset context, exploitability, business criticality, and available threat information to validate severity and recommend an appropriate response. · Investigate findings by reviewing cloud configurations, resource relationships, platform evidence, and available logs or metadata. Document the technical basis, affected resources, recommended remediation, and any applicable exception or compensating control. · Coordinate remediation with engineering and service teams. Track progress against agreed service targets, follow up on overdue or recurring issues, validate fixes in the CNAPP platform, and escalate material or time-sensitive exposure through established processes. · Administer and support CNAPP capabilities, including user and role access, cloud account and subscription onboarding, integrations, asset inventory, notification routes, policy configuration, and platform settings. · Improve platform coverage and signal quality by tuning existing policies, adjusting thresholds, testing new or changed detections, and reviewing false positives, missed coverage, and recurring finding patterns with the relevant security and engineering partners. · Build and test modest platform enhancements such as custom policies, dashboards, reports, API-based utilities, workflow changes, or integrations. Maintain clear change notes and supporting procedures, and follow the organization’s change and release practices. · Prepare operational reporting on exposure trends, remediation status, platform coverage, finding quality, and service health. Explain notable changes and data limitations so teams can act on the results. · Contribute to security risk assessments, cloud security reviews, incident investigations, and audit evidence requests involving CNAPP data or cloud attack surface exposure. · Maintain runbooks and knowledge articles for recurring operational tasks. Share platform guidance with users and help improve support handoffs and repeatable triage practices. Working Relationships Partners with Cloud Engineering, Platform Engineering, DevOps, application teams, Security Operations, Security Architecture, and oth