Information Security Engineer (Websites, Email & Google Workspace)

About the Role

This is a hands-on engineering role, not SOC monitoring and not GRC/compliance. You'll personally configure email authentication, Google Workspace security and website protections, and drive fixes through to production.

Priority #1 for this role: close the gaps our recent external audit found, then keep pushing our attack surface tighter from there, so our websites and client portals stay up and untampered, our email domains can't be used to scam people, and our data doesn't walk out the door. No security posture is ever fully "done", what we want is someone who keeps this at the top of their list, not squeezed in between other things.

We're hiring an Information Security Engineer to own the external security of our company websites and client-facing portals, our email domains, and our data. You'll work closely with our DevOps team (who own infrastructure execution) and our in-house developers (who own application code) to get fixes shipped, and you'll run our external pentest/audit program as the outside check that it's actually working.

There's a secondary layer of work too (access governance across our ~40-service SaaS portfolio, evaluating security tooling). You own that as far as your bandwidth allows. If it starts eating into the primary mission, that's your signal to make the case for hiring someone under you, not to let either side slip.

Reports to: CIO

Key Responsibilities

Priority #1: close and keep closing the external attack surface

• Own the security and integrity of our public websites and client-facing portals: hardened access to DNS/CDN/hosting panels so changes can't happen outside a controlled process, removal of wildcard DNS records, closing of exposed admin/API endpoints

• Stop email spoofing and account takeover: SPF and DMARC on every company domain, moved all the way from p=none to p=reject, with DKIM verified for every sending system (Google Workspace, Zoho, SendPulse, and others), plus enforced…