Job Description & Details
This is a hands-on GRC and security operations role where you won't just be writing policies, but actually driving security assessments and cloud defense strategies. If you enjoy bridging the gap between compliance frameworks and real-world threat analysis, this hybrid gig in Dallas is worth a serious look.
What You'll Actually Be Doing
You'll be splitting your week between digging into cloud security posture, running audits, and mentoring the internal team on incident response best practices. Expect to review process flows, troubleshoot security gaps across AWS, Azure, and GCP, and actively participate in threat analysis using modern SIEM and EDR tooling. It's a mix of strategic advisory work and technical execution where your recommendations will directly shape their security posture.
The Core Tech Stack
You need deep fluency in the NIST Cybersecurity Framework, cloud security models across AWS, GCP, and Azure, and solid familiarity with frameworks like MITRE ATT&CK. On the tooling side, they rely heavily on SIEM platforms like Microsoft Sentinel or Splunk, alongside EDR heavyweights like CrowdStrike or Microsoft Defender. Being able to map these tools back to GRC requirements and risk management initiatives is non-negotiable.
Interview Expectations
Expect the hiring manager to throw a realistic incident response scenario your way, asking you to map out an active threat using the MITRE ATT&CK kill chain while explaining how you'd contain it using your EDR and SIEM tools. They are secretly testing whether you can think on your feet under pressure or if you just memorize textbook definitions. You'll also likely get grilled on how you handle compliance friction with engineering teams, so be ready to share a practical story about balancing security mandates with product velocity.
Application Advice
Skip the generic resume summary and tailor your experience directly around the core frameworks mentioned here—specifically NIST CSF, AWS/Azure/GCP cloud security, and hands-on SIEM/EDR deployment. Highlight metrics from past audits, risk assessments, and incident responses to prove you can deliver tangible results from day one. Make sure keywords like 'threat analysis', 'vulnerability management', and 'GRC' are clearly visible in your experience section to pass the initial automated filters.