Top Cyber Security Jobs in Philadelphia, PA

Lead detection, response, and digital forensics for security incidents. Monitor alerts, perform technical analysis, act as Incident Commander, build automation and runbooks, mentor engineers, and coordinate cross-team investigations and insider threat work.

This role involves owning the security architecture for AI platforms on GCP, designing guardrails, and integrating security into CI/CD pipelines. Candidates should have extensive experience in cloud security, specifically with GCP services, Kubernetes security, and AI/ML security practices.

Manage security operations and lead a security engineering team defending endpoints, SaaS, infrastructure, and corporate systems. Serve as senior Incident Commander, oversee detection and response using CrowdStrike, conduct cybersecurity risk assessments, and improve vulnerability, patch, access, and configuration management. Build detection coverage across endpoint, identity, SaaS, and cloud signals while partnering with AppSec and technical leaders. Lead the company’s AI security strategy and develop specialized security capabilities.

Conduct third-party security assessments, evaluate vendor controls, document risk findings, and automate governance workflows using Python and coding tools. Configure integrations across ticketing, GRC, and vendor-management platforms; develop risk dashboards and reporting; and partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy. The role also supports security governance process improvements and applies frameworks including NIST, ISO 27001, SOC 2, and PCI DSS.

Lead field-facing AI security strategy for enterprise accounts: architect AI security solutions, deliver demos/POVs, advise on LLM/RAG/agent risks, scale enablement assets, and feed product roadmap with customer feedback to securely enable enterprise AI adoption.

Lead end-to-end Application Security product and program: set strategy, prioritize roadmap, ship AI-powered threat modeling and code-evaluation surfaces, enable secure-by-design SDLC, enforce CI/CD gates, drive vulnerability prioritization/remediation, establish governance and metrics, and align security initiatives with engineering and executive stakeholders.

Lead design and implementation of secure global network infrastructure. Architect security standards, conduct threat modeling and network assessments, build security automation and tooling, integrate controls with SDN/BGP/MPLS platforms, support incident response, and mentor engineering teams to maintain resilient, observable network security posture.

Lead cloud security strategy and engineering across AWS infrastructure, applications, data, Kubernetes, CI/CD, and cloud-native systems. Design security controls for identity, networking, workloads, secrets, monitoring, and vulnerability management; automate guardrails; assess broader risks and attack paths; guide architecture and incident response; define security metrics; and influence engineering teams through technical leadership and communication.

Lead corporate security investigations and incident response across identity, endpoints, SaaS, email, and security platforms. Improve detection, response, Zero Trust controls, automation, and incident readiness. Conduct vendor security assessments, support customer security questionnaires, document risk decisions, and collaborate with Security, IT, Engineering, Legal, GRC, Procurement, Sales, and Customer Success teams.

Owns IT systems administration and security operations for a fully remote workforce. Responsibilities include managing Microsoft 365 and Google Workspace, endpoint and identity platforms, security tools, access controls, threat monitoring, incident response, vulnerability management, compliance evidence, disaster recovery, vendor relationships, reporting, and operational roadmaps.

Owns the architecture and technical roadmap for the Ping Identity platform. Designs enterprise SSO, MFA, identity governance, application integrations, RBAC and ABAC frameworks, lifecycle management, and cloud or hybrid deployments. Leads migration and multi-region availability strategies while producing architecture designs, solution blueprints, integration standards, and audit-ready runbooks.

Manage SOC 1, SOC 2, and ISO 27001 compliance programs, including internal and external audits, control enforcement, corrective actions, and policy updates. Monitor security alerts, support incident investigations, coordinate penetration testing, and administer password and phishing management systems. Lead security awareness initiatives, advise stakeholders, collaborate with Legal on encryption regulations, and drive continuous improvements to the organization’s information security posture.

Security Engineer responsible for application security, vulnerability and threat management, cloud and Kubernetes security, DevSecOps tooling, incident response, forensic analysis, and secure system architecture. The role integrates security testing into CI/CD pipelines, automates security tasks, supports IAM and cryptographic key management, and collaborates with engineering teams to strengthen security processes and tooling.

Leads complex digital forensics and incident response engagements, including ransomware, APT, nation-state, insider threat, host and network forensics, malware triage, cloud investigations, and threat attribution. Provides technical oversight, client leadership, methodology development, mentorship, tooling improvements, pre-sales support, and external thought leadership. Participates in on-call coverage and supports high-severity incident surges.

Designs, deploys, configures, migrates, and troubleshoots Palo Alto Networks security infrastructure in customer environments. Responsibilities include firewall, Panorama, Prisma, Strata Cloud Manager, and GlobalProtect implementation; migration from legacy platforms; routing and switching support; change-window execution; technical design and migration documentation; post-deployment stabilization; and communication with customers, account teams, and engineering. Travel to customer sites and evening, overnight, or weekend maintenance windows may be required.

Supports the deployment, configuration, integration, testing, migration, and troubleshooting of Palo Alto Networks, Zscaler, and other network security technologies for enterprise customers. Assists consultants with customer discovery, design workshops, implementation activities, technical documentation, and solution validation. Communicates technical concepts to technical and non-technical stakeholders while developing expertise in cybersecurity consulting, firewalls, networking, SASE, and cloud security.

Leads software security for Cisco’s IT and Enterprise Operations portfolio. Responsibilities include portfolio risk management, secure architecture and design reviews, threat modeling, AI and LLM security, analysis of SAST/DAST/SCA findings, remediation guidance, security SME coordination, leadership influence, release risk presentations, and security engineering metrics. The role drives risk-based security outcomes across engineering, product, IT, and operations teams without direct authority.

Lead software security for Cisco’s IT and Enterprise Operations portfolio. The role owns security posture, threat modeling, secure architecture reviews, AI and LLM security, risk-based remediation, security metrics, and release risk reporting. It partners with engineering, product, and IT leadership to drive security outcomes without direct authority, coordinate security subject-matter experts, and reduce security debt across cloud-native applications and enterprise platforms.

Designs, implements, and maintains security controls across Azure, GCP, and AWS environments. Manages cloud IAM, security posture, vulnerability remediation, policies, guardrails, and infrastructure security. Partners with engineering and DevOps teams on CI/CD and infrastructure-as-code security, conducts assessments, supports cloud incident response, develops SOC detection content, and documents security architectures. Requires three or more years of cloud security experience across at least two major cloud platforms.

Build and operate cloud security controls across AWS, Azure, GovCloud, and secondary platforms. Responsibilities include IAM, encryption, secrets management, preventive and detective controls, PHI protection, logging pipelines, Terraform and CI/CD automation, remediation, application and vendor design reviews, and audit evidence for HITRUST, HIPAA, SOC 2, FedRAMP, and internal assessments.

Lead cybersecurity detection and response operations, including complex incident handling, alert triage, SIEM rule authoring and tuning, threat hunting, playbook development, and response automation. Mentor SOC analysts, establish documentation and escalation standards, conduct post-incident reviews, and drive remediation and detection strategy improvements. Present technical findings to executives and influence cross-functional security outcomes.

Lead assessment and mitigation of security risks in the virtualization stack. Build threat models, rubrics, and defenses; partner with kernel, virtualization, and provisioning teams to design and implement mitigations; mentor engineers, manage vulnerability backlog, and promote security best practices across product teams.

Design, implement, and maintain scalable cloud security controls for Vercel's platform. Harden infrastructure using infrastructure-as-code and policy enforcement, secure CI/CD pipelines, perform threat modeling and risk analysis, improve monitoring and incident response, and build platform-level security tooling in collaboration with platform and infrastructure teams.

Own and define IAM strategy for corporate and production environments. Migrate Okta to Terraform, design least-privilege access, automate provisioning/deprovisioning and access reviews, build/manage MDM/MAM tooling, partner with platform and engineering teams, and serve as the IAM subject matter expert across Security, IT, and Engineering.

Design, maintain, and extend abuse detection and prevention systems for GitLab's SaaS platform. Serve as a core maintainer of a Ruby on Rails monolith, build anomaly detection and agentic AI mitigations, automate abuse response, collaborate with peer engineering and security teams, and produce runbooks and operational documentation.