Top Cybersecurity Jobs in New York City, NY

Monitors, investigates, and responds to security incidents across hybrid and cloud environments. Responsibilities include SIEM/EDR/XDR monitoring, threat hunting, cloud log analysis, digital forensics, incident containment and recovery, playbook development, reporting, and participation in security exercises. The role protects organizational assets, supports cloud security posture improvement, and reduces detection and response times.

Leads the enterprise cybersecurity incident response function as senior incident commander and people leader. Directs containment, eradication, recovery, investigations, evidence handling, regulatory notifications, executive communications, crisis coordination, and post-incident improvement. Establishes incident response governance, playbooks, metrics, readiness objectives, and audit processes while coordinating security, technology, legal, compliance, business, vendors, and executive stakeholders. Builds and manages a multidisciplinary response team and maintains continuous coverage for high-impact incidents.

Leads enterprise authentication engineering strategy, architecture, delivery, reliability, and user experience across workforce, applications, APIs, cloud, hybrid environments, non-human identities, and AI agents. Oversees federation, SSO, MFA, passkeys, authorization, PKI, workload identity, and continuous authentication. Directly manages authentication engineers, including hiring, staffing, performance management, technical guidance, and career development. Represents Cybersecurity in governance forums and drives secure, scalable authentication modernization.

Support annual cybersecurity compliance certifications, regulatory examinations, reporting, and information requests. Maintain requirement and evidence trackers, coordinate stakeholders and control owners, review documentation for accuracy and completeness, organize repositories, manage executive DocuSign approvals, and support SEC and FINRA compliance reporting. Identify process improvements and assess cybersecurity controls and technology risk evidence. The role requires strong organization, project management, communication, analytical, and stakeholder management skills.

Owns the architecture, engineering, modernization, and automation of enterprise PKI, certificate lifecycle, HSM/KMS-backed services, and cryptographic infrastructure across on-premises and multi-cloud environments. Builds certificate APIs and integrations with ServiceNow, CI/CD, Kubernetes, and identity platforms. Serves as the technical authority for PKI risks, security reviews, incident response, resiliency, cryptographic agility, and post-quantum readiness.

Design and implement application security controls for AI applications, agentic systems, and Vertex AI platform services. Build guardrails against prompt injection, unsafe tool invocation, data exfiltration, and model abuse. Integrate security into CI/CD, software development lifecycles, infrastructure-as-code, and cloud environments. Partner with AI, MLOps, cloud engineering, data science, and model risk teams while developing Python automation, detection capabilities, and reusable security standards.

This role involves owning the security architecture for AI platforms on GCP, designing guardrails, and integrating security into CI/CD pipelines. Candidates should have extensive experience in cloud security, specifically with GCP services, Kubernetes security, and AI/ML security practices.

Lead the enterprise patch and vulnerability remediation operating model: intake, triage, prioritization, SLA enforcement, remediation orchestration, reporting, and closure across on‑prem, cloud, endpoints, and applications. Drive governance forums, coordinate cross‑team remediation, produce executive dashboards, escalate blockers, and improve closure quality and automation.

Own and operate endpoint patch deployment and remediation for workstations and user devices: manage pilot rings and rollback groups, monitor patch success and endpoint health, validate post-patch functionality, coordinate incident triage with cross-functional teams, and improve automation, reporting, and evidence capture for vulnerability remediation.

Monitor, detect, investigate, and respond to security alerts across cloud and on‑premises environments using SIEM and EDR/XDR. Conduct threat hunting, malware analysis, and incident response; analyze cloud telemetry (AWS/GCP); develop playbooks and automation; collaborate with engineering and platform teams to improve detection, automate response, and strengthen cloud security posture.