IT Security Specialist

Published: 6/14/2022

Technology

Job Description

The IT Security Specialist is DTLR's first dedicated security role, owning day-to-day protection of our corporate offices, distribution operations and retail stores. You will turn security work that is currently spread across the infrastructure, identity and helpdesk teams into a single, measurable program.

You will focus on identity and endpoint security across Microsoft 365 and Entra ID, PCI DSS compliance for store payment systems, security monitoring and first-line incident triage alongside our incident response vendor, partnering with network engineers to strengthen network security, and security awareness for corporate and store employees. This is a hands-on role with room to shape policies, tooling and the roadmap as the program grows.

Responsibilities:

Identity and access security

Administer and harden Microsoft Entra ID security: Conditional Access, MFA, privileged access (PIM), and identity protection risk policies.

Run periodic access reviews for privileged accounts, service accounts, guest users and cross-tenant access.

Partner with the helpdesk on secure onboarding, offboarding and account-recovery procedures.

Endpoint, email and cloud security

Manage Microsoft Defender (Endpoint, Office 365, Identity and Cloud Apps) and Intune security baselines across Windows, mobile and Android store devices.

Tune email security, phishing protection and data loss prevention policies in Microsoft 365.

Track vulnerabilities and drive patch and remediation timelines with system owners.

Payment and compliance

Own day-to-day PCI DSS compliance activities: scope tracking, quarterly scans, evidence collection and annual assessment support.

Help keep cardholder data environments segmented and minimized as store POS and payment systems change.

Maintain security policies, standards and a risk register; support vendor security reviews.

Monitoring, triage and vendor coordination

Monitor security alerts from Defender and other tools; triage, investigate and resolve lower-severity findings in-house.

Escalate major incidents to our outsourced incident response vendor and act as DTLR's primary technical liaison during their engagement.

Manage the vendor relationship: escalation criteria, contact paths, retainer terms and post-incident reviews.

Maintain internal playbooks for the activities handled in-house and for the handoff to the vendor.

Work with the infrastructure team to confirm backups are protected and recoverable (immutability, isolation, restore testing).

Network security

Partner with DTLR's network engineers to understand the corporate, store and distribution network architecture, including the Cloudflare services they manage.

Review firewall, VPN, Wi-Fi, segmentation and Cloudflare configurations from a security perspective and recommend improvements.

Identify network security gaps and risks, and work with the network team to prioritize and track remediation.

Assess security of new network, cloud and SaaS deployments before go-live.

Awareness and enablement

Run security awareness training and phishing simulations for corporate and store employees.

Serve as the escalation point for security questions from the helpdesk and business teams.

Report program metrics and top risks to IT leadership monthly.

Required qualifications

3+ years in IT, with at least 2 years focused on information security, systems administration or security operations.

Hands-on experience with Microsoft 365 and Entra ID security, including Conditional Access and MFA.

Working experience with an EDR/XDR platform, preferably Microsoft Defender.

Solid understanding of networking fundamentals: TCP/IP, DNS, firewalls, VPNs and network segmentation.

Experience investigating security alerts and documenting incidents.

Familiarity with PCI DSS or a comparable compliance framework (NIST CSF, CIS Controls, SOC 2).

Bachelor's degree in IT, cybersecurity or a related field, or equivalent experience.

Ability to participate in an on-call rotation for security incidents.

Preferred qualifications

Experience in retail or another multi-site environment with point-of-sale and payment systems.

Experience with Microsoft Sentinel or another SIEM, including writing KQL queries and detection rules.

Experience securing Android or other mobile device fleets through Intune or a similar MDM.

Familiarity with Cloudflare security services (WAF, Zero Trust, DNS); exposure to Meraki or other cloud-managed network platforms.

Familiarity with backup security practices such as immutable storage and recovery testing.

Scripting skills in PowerShell or Python for automation and investigations.

One or more certifications: CompTIA Security+ or CySA+, Microsoft SC-200 or SC-300, SSCP, GIAC (GSEC, GCIH), or CISSP for senior candidates.

Skills and competencies

Risk judgment: weighs security against store operations and picks practical controls over perfect ones.

Clear communication: explains risks and incidents to executives, store managers and helpdesk staff in plain language.

Ownership: sees issues through to closure and keeps documentation current.

Calm under pressure: leads an orderly response during active incidents.

Collaboration: works across infrastructure, identity, helpdesk, finance and loss prevention teams.

Continuous learning: keeps up with threats targeting retail, payments and Microsoft environments.

Working conditions

Hybrid schedule (remote considered), with occasional travel to stores and distribution sites for assessments or incident response.

Participates in an on-call rotation and may work outside normal hours during incidents or maintenance windows.

Must pass a background check due to access to sensitive systems and payment environments.

#LI-DNI