Security Engineer III

Accountabilities:: Own the firewall estate across six properties, including platform strategy, reference architecture, vendor relationships, refresh planning, capacity planning, and high-risk migrations. Define and maintain security architecture standards covering firewalls, access control, network segmentation, hardening, rule lifecycle management, and documented exceptions. Establish an authoritative understanding of network environments across edge, core, plant, subscriber, and management planes, including trust boundaries and data flows. Lead the adoption of common security standards across properties while documenting and governing legitimate deviations. Maintain comprehensive security documentation, including architecture diagrams, standards, runbooks, decision records, and review processes. Develop and maintain a security posture roadmap aligned with NIST CSF and CIS Controls, including current-state assessments, remediation priorities, and executive-level metrics. Own cybersecurity and supply chain risk management plans supporting broadband grant requirements and relevant regulatory obligations. Support CPNI requirements, lawful-process handling, breach notification analysis, audit readiness, and cyber insurance evidence requirements. Lead major security initiatives such as zero-trust network access, privileged access management, endpoint protection consolidation, resilient out-of-band access, and security logging. Evaluate security vendors, support contract and renewal negotiations, manage technical engagements, and contribute to security budgets and multi-year capital planning. Serve as technical incident commander during major security incidents, leading containment, forensic readiness, evidence handling, and break-glass access procedures. Run tabletop exercises and coordinate with legal and compliance stakeholders regarding notification thresholds and regulatory exposure. Drive automation for policy-as-code, drift detection, rollback capabilities, and tamper-evident audit evidence while personally contributing to implementation. Establish responsible use of AI tooling within security workflows, keeping AI advisory and outside the production control path. Mentor Tier I and Tier II engineers and develop the internal capability to independently execute security migrations and initiatives. Define and manage first-year outcomes, including firewall estate modernization, standardized security controls, complete documentation, posture improvements, current compliance evidence, and reduced critical findings. Requirements: 8+ years of experience in network and security engineering, including at least 3 years in a senior or lead role responsible for setting standards while remaining hands-on. Proven experience designing and implementing multi-site security architectures. Expert-level firewall expertise, including centralized management at scale and leadership of firewall migrations. Strong service-provider security knowledge, including BGP security controls, DDoS mitigation, subscriber-network separation, and the differences between carrier and enterprise infrastructure. Demonstrated ownership of vulnerability management and security hardening programs, including reporting to executives or risk committees. A strong portfolio of written security standards, architecture documentation, and technical decision records. Ability to independently assess an environment, establish priorities, and develop a defensible 12-month security roadmap. Strong written and verbal communication skills, with the ability to present technical recommendations in a way that senior non-technical stakeholders can act on. Experience managing security exceptions, standards, architecture approvals, vendor relationships, and technical escalations. CISSP, CISM, or advanced platform certifications such as PCNSE, NSE 8, or CCIE Security are preferred. Experience with regional operators, cooperatives, municipal providers, or other lean security teams is a plus. Experience standardizing independently operated or acquired environments is preferred. Knowledge of regulated data requirements such as CPNI, PCI DSS scope reduction, or CALEA-related processes is advantageous. Experience with BEAD or state broadband security requirements and grant compliance is a plus. Prior ownership of security budgets or vendor portfolios is preferred. Ability to work remotely while collaborating across multiple locations and time zones. Must be able to reside within driving distance of a designated property in Winona, MN; Sergeant Bluff, IA; Maricopa, AZ; Hagerstown, MD; Burlington, VT; or New Knoxville, OH. Ability to work occasional after-hours and weekend maintenance windows and participate in an on-call rotation. Ability to travel between properties and work in office, data center, headend, and outside-plant environments. Ability to lift and position equipment weighing up to 50 pounds and rack and cable hardware. Benefits: Annual compensation of $108,000–$138,000. Remote work with proximity to a designated property. Group health and dental insurance. 401(k) program with company match. Generous paid time off program. Company wellness program. Employer-paid short-term and long-term disability coverage. Opportunity to own enterprise-wide security architecture and a multi-year security roadmap. Senior individual contributor role with significant technical authority and autonomy. Exposure to complex broadband, network security, compliance, incident response, and infrastructure environments. Opportunity to mentor engineers and shape security standards across multiple properties.