Senior Internal Security & Security Operations Engineer

About the role

UltaHost is looking for a Senior Internal Security & Security Operations Engineer to take ownership of internal security and strengthen the protection of its workforce, identities, systems and day-to-day operations. This is a senior, hands-on technical role covering Identity & Access Management (IAM), security monitoring, SOC operations and incident response, combining strong technical expertise with a structured, operational approach.

Key responsibilities

• Secure employee and contractor identities, privileged access, credentials, internal systems, endpoints, VPN and remote access, and maintain security controls across the account and access lifecycle.
• Design and maintain RBAC, manage MFA, SSO, PAM, password vaults, API keys, SSH keys, recovery codes and secrets, and run regular access reviews.
• Identify and remove shared, dormant, unnecessary and overly privileged accounts, and own controls for onboarding, role changes, temporary and contractor access and offboarding.
• Monitor and investigate alerts from SIEM, EDR, IDS/IPS, authentication systems, cloud/SaaS platforms and endpoints, and lead internal security incidents.
• Investigate suspicious logins, compromised accounts, credential leaks, malware, privilege abuse and insider risk, collect evidence, contain threats and drive corrective actions to closure.
• Maintain detection rules, alert quality, incident records, escalation paths and response playbooks.
• Define security requirements for laptops, VPN, remote access, email, code repositories, support platforms and finance tools, and work with HR and IT on joiner/mover/leaver processes and investigations.
• Support security awareness, phishing prevention and secure handling of sensitive information.

Required profile

• 5+ years of hands-on experience in internal security, IAM, SOC/security operations, incident response, IT security or a closely related role.
• Proven ability to investigate compromised accounts, malware, credential leaks, suspicious authentication activity, insider risk and unauthorized access.
• Strong organizational skills and the ability to enforce security controls while working with HR, IT, managers and system owners.
• Not a policy/compliance-only profile: real hands-on experience administering access controls, using security tooling, investigating logs and responding to incidents.
• Preferred: experience in web hosting, cloud infrastructure, data centers, SaaS, fintech, MSSP or similar environments; preferred certifications include Security+, CySA+, GCIH, SC-200, IAM/PAM vendor certs, CISSP or equivalent.

Required skills

• RBAC, MFA, SSO, PAM, identity providers, password management and access auditing
• SIEM, EDR, IDS/IPS, centralized logging, alert triage and case management
• Linux access, SSH, VPN, endpoints, cloud/SaaS administration, email security and remote-workforce security