Information Security Associate Engineer

EMPLOYERS is a provider of workers' compensation insurance and services. The Information Security Associate Engineer will help protect applications, infrastructure, data, and cloud environments by monitoring security tooling, managing vulnerabilities, supporting IAM and cloud security, responding to incidents, and improving security controls.

What you'll do:

• Monitor security alerts, logs, and dashboards (SIEM/SOAR) to identify, triage, and escalate potential security incidents
• Assist in performing vulnerability assessments and coordinate remediation of findings across applications, infrastructure, and cloud resources
• Support the configuration, hardening, and maintenance of cloud environments (AWS, Azure), including identity, network, storage, and workload security controls
• Use cloud security posture management (CSPM) and cloud-native tools to detect misconfigurations, excessive permissions, and non-compliant resources
• Support identity and access management (IAM) activities, including access reviews, role-based access control (RBAC), and least-privilege enforcement
• Assist with incident response activities, including evidence gathering, containment support, and documentation of findings and timelines
• Develop and maintain technical security documentation, including runbooks, diagrams, playbooks, and standard operating procedures
• Support security control implementation aligned to frameworks such as NIST CSF, ISO 27001, or CIS Benchmarks
• Assist with risk assessments, helping identify, document, and prioritize security risks across systems, applications, and cloud environments
• Participate in code and architecture reviews to identify security weaknesses and recommend secure design practices (e.g., OWASP Top 10)
• Assist with encryption key management, secrets management, and secure configuration of data at rest and in transit
• Support patch management and endpoint protection efforts across servers, workstations, and cloud workloads

What they're looking for:

• 0-3 years of experience in information security, IT security, or a related technical field
• Bachelor's degree in computer science, cybersecurity, information systems, or a related field, or equivalent experience
• Equivalent combinations of education and experience may be considered
• Exposure to cloud security concepts and at least one major cloud provider (AWS or Azure), including shared responsibility model concepts
• Basic understanding of risk assessment concepts, including identifying, rating, and prioritizing risk based on likelihood and impact
• Familiarity with security tools such as SIEM, vulnerability scanners, endpoint detection and response (EDR), or cloud-native security services
• Basic understanding of networking concepts (firewalls, VPNs, segmentation, DNS) and common attack techniques
• Familiarity with identity and access management concepts, including MFA, SSO, and role-based access control
• Proficiency or working knowledge of at least one scripting or programming language (e.g., Python, PowerShell, Bash) for automation and analysis
• Knowledge of common security and compliance frameworks (e.g., NIST CSF, ISO 27001, CIS Controls, SOC 2)
• Exposure to Windows and Unix-variant operating systems in a security or administrative context
• Ability to discuss technical security concepts clearly with non-technical stakeholders, ensuring mutual understanding

Benefits:

• 100% remote, open to candidates currently located in the United States who are able to work without sponsorship.
• A comprehensive benefits package