MIS Security Engineer

WAGE RANGE: $90K -$125K

OPEN UNTIL FILLED, 1ST PULL DATE : NOVEMBER 6TH, 2026

JOB SUMMARY

This is considered a SR position. Security Engineer is a hands-on technical leader responsible for building and operating a practical cybersecurity program that protects WRC’s systems, data, and 24/7 business operations. Working with the IT Manager, this role turns business risks into security priorities, implements and tests controls, and leads detection and incident response. The Security Engineer supervises the Security team and provides technical direction and support to the Network, Systems, and Service Desk teams as they secure their areas of responsibility. The role owns data security practices and helps leadership make informed risk and investment decisions, balancing protection, operational reliability, staff capabilities, and cost.

ESSENTIAL JOB FUNCTIONS:

1. Develops and maintains a risk-based cybersecurity roadmap to translate business needs, threat exposure, and control gaps into practical and achievable priorities that account for staffing, skills, budget, company culture, and the needs of a 24/7 operation.
2. Leads, mentors, and supervises the Security team, setting expectations, assigning work, providing training, and reviewing performance. Serves as senior IT leader and assists in representing Wildhorse leadership to IT members and WRC team members alike. Accountable for the Security team’s readiness, work quality, and follow-through during projects, routine operations, and incidents.
3. Leads implementation of an established cybersecurity framework to assess current practices, define a practical security baseline, and prioritize improvements. Establishes control owners, maintains evidence of implementation, and tests whether controls work as intended.
4. Identifies and assesses cyber risks to business services and data, including third-party dependencies, and estimates potential operational and financial impacts. Maintains a prioritized risk register, tracks remediation, and brings risk acceptance decisions to the IT Director.
5. Reports security posture, unresolved risks, control effectiveness, and improvement progress to leadership in clear business terms. Evaluates proposed investments by comparing cost, operational impact, and expected risk reduction, with assumptions and limitations made explicit.
6. Designs, implements, and validates security controls across identity, endpoints, networks, applications, and cloud services. This work includes least privilege, multifactor authentication, secure remote access, network segmentation, network access controls, system hardening, and protection of sensitive data.
7. Provides security design reviews and technical guidance for projects, expansion, and system changes. Works with Network, Systems, Service Desk, vendors, and business stakeholders to define security requirements, coordinate implementation and testing, and establish clear operational responsibilities.
8. Manages the operational relationship with third-party managed detection and response (MDR) providers. This includes verifying monitoring coverage, investigating and acting on alerts, tuning detections, defining escalation paths, and reviewing provider performance so that security telemetry leads to timely action.
9. Operates and maintains security platforms throughout their lifecycle, including configuration, upgrades, monitoring, troubleshooting, and configuration backups. Addresses gaps in logging or coverage and verifies that security tools remain reliable, effective, and supportable.
10. Owns the vulnerability management process, coordinating assessment, prioritization, and remediation with system owners. Findings are evaluated against exposure, exploitability, and business impact, with clear owners, target dates, documented exceptions, and verification that corrective actions address the risk.
11. Owns the data security and classification program, working with business owners to identify sensitive information and define handling, access, retention, and sharing requirements. This includes implementing practical protections and reviewing inappropriate access or exposure.
12. Evaluates emerging threats, including AI-assisted attacks, and security risks associated with the organization’s use of AI. Develops practical guidance and AI safeguards for sensitive data, access, and verification of high-risk requests, adapting controls as threats and business practices change.
13. Maintains a concise incident response plan supported by separate, reusable technical procedures and scenario-specific playbooks. As part of incident response, leads tabletop exercises and coordinated technical tests, clarifies team and vendor responsibilities, and tracks lessons learned through corrective action.
14. Leads the technical response to suspected or confirmed security incidents, coordinating investigation, containment, evidence preservation, recovery, and communication with internal teams and external responders. Occasionally receives, triages, escalates, and responds to critical security alerts outside business hours as assigned.
15. Builds security awareness and practical skills across IT and the business through coaching, targeted training, and clear guidance. Works with employees and managers to make secure practices usable and to encourage prompt reporting of suspicious activity or mistakes.
16. Maintains centrally accessible documentation for security architecture, configurations, standards, operating procedures, response actions, and support handoffs.
17. Follows established policies, procedures, and applicable requirements and performs other related duties as assigned.

PROMOTE WRC QUALITY SERVICE STANDARDS:

SAFETY: Ensuring a safe experience by protecting the welfare of all.

INTEGRITY: Expecting personal accountability at every level.

COURTESY: Creating an exceptional customer service experience for everyone.

TEAM: Functioning together to create a cooperative and positive experience.

SHOW: Providing flawless experience –a clean and cared for resort.

SUPERVISORY AUTHORITY:

1. Security Administrator

SIGNATORY ABILITY:

1. Access and System Logs, User Credentials.

ACCESS TO SENSITIVE AREAS:

1. Access and System Logs, User Credentials.
2. Controlled IT areas.
3. Secured areas within established access procedures.

MINIMUM QUALIFICATIONS:

1. Bachelor’s degree in information technology or related field and at least three (3) years directly applicable experience, OR Associate’s degree in information technology or related field and four (4) years of IT experience, OR five (5) years directly applicable experience.
2. At least three (3) years of progressively responsible experience in cybersecurity, network security, incident response, or closely related work with substantial security responsibilities.
3. At least one (1) year of direct staff supervision, including assigning work, coaching employees, and evaluating performance.
4. Have hands-on experience implementing and troubleshooting security controls in a production environment. Able to apply access control, secure configuration, segmentation, logging, vulnerability remediation, and recovery principles while considering availability and operational impact to a 24/7 organization.
5. Must be able to plan and deliver technical work across teams, including defining outcomes, estimating effort, managing dependencies, and communicating progress or blockers. Maintain usable documentation and verify work completion.
6. Able to assess security risks, prioritize improvements, and explain options and impact to technical and nontechnical audiences.
7. Must communicate clearly, coach others, and build effective working relationships with employees, managers, and service providers. They must be able to explain security expectations, resolve competing priorities constructively, and support teams without taking over their operational responsibilities.
8. Able to investigate unfamiliar technical problems using logs, network traffic, system behavior, documentation, and structured reasoning. Understand common network and identity dependencies and know when to involve teammates, vendors, or specialist support.
9. Able to demonstrate ongoing technical learning and sound judgment when evaluating unfamiliar technologies and emerging threats, including distinguishing meaningful risks from noise.
10. Demonstrable experience contributing to security monitoring, incident response, or incident preparedness. Able to turn findings into corrective actions and investigate with internal teams and service providers.
11. Demonstrable understanding of how to identify and protect sensitive data through classification, access controls, appropriate sharing, and retention practices. Able to translate principles into workable plans with business and technical owners.
12. Requires a High Security Gaming License clearance.
13. Must be at least 21 years of age.

PREFERRED QUALIFICATIONS:

1. A bachelor’s degree in cybersecurity, information technology, or a related field is preferred. Candidates without a degree may qualify through the relevant experience and demonstrated capabilities described above.
2. Experience securing operational technology, business-critical infrastructure, or environments that operate around the clock.
3. Experience applying a cybersecurity framework, developing incident response plans, leading exercises, or evaluating control effectiveness.
4. Experience securing Microsoft 365, Entra ID, Active Directory, Windows Server, or comparable enterprise platforms.
5. Experience with endpoint detection and response, centralized security logging, managed detection and response providers, or data protection tools is preferred.
6. Experience using PowerShell, Python, or other scripting tools to automate security work, improve telemetry, or reduce manual effort.
7. Relevant security or networking certifications, or comparable evidence of applied learning such as security research, lab work, or technical projects.