Remote opportunity at
CisionSenior Security Engineer
Cision, a technology business serving PR and social media teams, is hiring a Senior Security Engineer to watch for and look into security events spanning cloud,…
Career Tools
About This Role
Cision, a technology business serving PR and social media teams, is hiring a Senior Security Engineer to watch for and look into security events spanning cloud, identity, endpoint and Linux setups. The listing is marked remote. The role calls for hands-on technical skill, strong scripting ability and practical AWS experience, with GCP experience preferred. Day to day, the engineer watches alerts from cloud, identity, endpoint and network sources and goes…
Job Description
Cision, a technology business serving PR and social media teams, is hiring a Senior Security Engineer to watch for and look into security events spanning cloud, identity, endpoint and Linux setups. The listing is marked remote. The role calls for hands-on technical skill, strong scripting ability and practical AWS experience, with GCP experience preferred.
Day to day, the engineer watches alerts from cloud, identity, endpoint and network sources and goes through logs coming from AWS, GCP, Active Directory and both Linux and Windows machines. The role supports incident response by collecting evidence, checking suspicious activity and recording findings. Scripts are used to automate repetitive chores, analyze logs, produce reports and enrich data.
The engineer also helps review IAM settings, bucket exposure, compute workloads and network setups, and works with internal teams on remediation, compliance and audit activity. Candidates should be prepared to respond outside normal hours when an urgent security event needs attention.
The hiring process includes a hands-on exercise over screen sharing in which candidates demonstrate relevant technical skills. Cision describes itself as an equal opportunity employer and asks candidates who need accommodation to contact its HR support team.
Responsibilities
- Triage and dig into security warnings coming from cloud, identity, endpoint and network sources
- Go through logs from AWS and GCP, Active Directory, and Linux and Windows hosts, plus security products
- Assist incident response: collect evidence, verify suspicious activity, record findings
- Create scripts that take over repetitive security chores such as log parsing, reports and data enrichment
- Assist security reviews covering IAM, bucket exposure, VM workloads and network setup
- Look into sign-in patterns, user actions, privilege escalations and possible account takeovers
- Collaborate with internal groups on fixing risks and meeting compliance or audit requirements
- Respond outside normal hours when an urgent security event needs attention
Requirements
- Solid knowledge of cloud security concepts, services, logging and IAM
- Hands-on with a SIEM product like Splunk, Chronicle or Sentinel, or a peer tool
- Strong scripting skills, ideally in Python, Bash or PowerShell
- Practical familiarity with Linux and Windows: shell work, permissions, processes and logs
- Foundational to intermediate knowledge of Active Directory, covering accounts, groups, sign-ins and privilege changes
- Ability to make sense of logs from cloud services, operating systems and security products
- Familiarity with attack patterns such as phishing, stolen credentials, privilege escalation, lateral movement, exposed services
- Clear analytical, documentation and communication skills
- Three to five years in SecOps, incident handling, sysadmin, cloud operations or comparable technical work
- A practical record of writing scripts to fix operational or security issues
- Able to work across cloud and Linux shell environments
Qualifications
- Background in GCP security, including IAM, Cloud Logging and service accounts
- Some work with Kubernetes, containers or cloud-native platforms
- Built automation for monitoring or responding to security events
- Familiarity with GitHub or GitLab workflows
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this job remote?
The listing is marked remote. The posting also asks candidates to be reachable outside normal hours when an urgent security event needs attention.
What core skills are required?
The posting asks for cloud security and IAM knowledge, scripting in Python, Bash or PowerShell, SIEM experience with tools such as Splunk, Chronicle or Sentinel, and a grasp of Linux and Windows administration.
How much experience is needed?
The posting asks for three to five years in SecOps, incident response, sysadmin, cloud operations or comparable technical work.
Is the interview practical?
Yes. The process includes a hands-on exercise conducted over screen sharing to demonstrate technical skills.
Is salary stated?
The posting does not state a salary.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
