Cybersecurity Engineer

WHY HILLPOINTE? Hillpointe is a fully integrated real estate development and investment management firm focused on developing market-rate workforce housing across the Sun Belt. Ranked at the top of NMHC's list of Builders and Developers, our team ensures best-in-class execution. Built on its long and proven track record of real estate development, the firm’s investment approach is centered around its in-house general contracting expertise, enabling direct control of cost and delivery timeframe. For each project, Hillpointe directly controls land acquisition, land development, construction, procurement of building materials, asset management, and capital markets. This is more than just a job - it's a career-defining opportunity! At Hillpointe, you'll be part of a dynamic, innovative team that has tangible impacts on day-to-day operations and contributes directly to overall success. Cybersecurity Engineer   The Cybersecurity Engineer owns the day-to-day security operations of the organization's fully cloud-based technology environment. This is the company's dedicated security role, and it operates with a high degree of independence: the incumbent drafts and sets the approved operational security agenda, oversees external MDR, drives vulnerability and access remediation with system owners, and carries the organization through external audit. Because the scope is broad by design, the role is structured to scale through leverage — directing managed security service providers and specialist vendors for around-the-clock monitoring and surge capacity, while retaining ownership of strategy, configuration, escalation, and outcomes in-house.   The successful candidate is equally comfortable investigating an alert at the console and explaining residual risk to business leadership. This is a high-visibility role with a direct line to decisions about how the organization protects its data, its residents' information, and its capital.   Key Responsibilities: Threat Detection & Incident Response   Own detection and response across cloud identity, endpoint, email, and cloud infrastructure, including triage, containment, eradication, and recovery   Serve as primary incident responder and incident commander for security events, coordinating internal stakeholders, managed service providers, and outside counsel or forensics as required   Maintain and exercise the incident response plan, including tabletop exercises and post-incident reviews that produce tracked corrective actions   Develop and tune detection rules, alert logic, and automated response playbooks to reduce mean time to detect and mean time to respond   Build and maintain runbooks for recurring incident types so that response is repeatable and not dependent on a single individual   Security Monitoring, SIEM & Reporting   Administer the security information and event management (SIEM) platform, including data source onboarding, log ingestion health, normalization, and retention configuration   Manage ingestion cost and data tiering to keep monitoring coverage aligned with budget   Build and maintain dashboards, analytics rules, and workbooks that provide operational visibility into the security posture of the cloud environment   Produce recurring security reporting for IT leadership and executive stakeholders, translating technical findings into business risk and clear recommendations   Define and track security metrics — detection coverage, alert volume and disposition, patch and remediation timeliness, phishing susceptibility, and audit readiness   Vulnerability & Configuration Management   Run the vulnerability management lifecycle across endpoints, servers, cloud workloads, and third-party platforms: discovery, assessment, risk-based prioritization, remediation tracking, and verification   Partner with system and application owners to drive remediation to closure, escalating where service-level targets are at risk   Assess and harden security configuration baselines against recognized benchmarks, and monitor for configuration drift   Coordinate external penetration testing and vulnerability assessments, and manage the resulting findings through to resolution   Maintain the risk register and formal exception process for accepted risks, with documented compensating controls and review dates   Identity & Privileged Access Governance   Administer privileged identity and privileged access management, including just-in-time elevation, approval workflows, activation justification, and time-bound role assignment   Conduct recurring privileged access reviews and audits, validating that standing administrative access is eliminated or justified and that every elevation is attributable   Own access review and recertification cycles across the cloud tenant and integrated business platforms, coordinating with business owners as reviewers   Review and strengthen conditional access, multifactor authentication, and device compliance policies, including break-glass account controls and their periodic testing   Monitor for identity-based threats — token theft, consent phishing, risky sign-ins, legacy authentication, and over-permissioned service principals and application registrations   Cloud & DevOps Security   Provide security oversight of the organization's cloud productivity tenant and cloud infrastructure platform, including tenant-level security configuration and posture management   Embed security into development and automation pipelines: secrets management, dependency and container scanning, infrastructure-as-code review, and pipeline identity and permission hygiene   Review and advise on cloud architecture changes, network segmentation, and secure-by-default configuration before deployment rather than after   Administer cloud-delivered secure access and secure web gateway capabilities for private application access, internet egress filtering, and cond