Job description

Are you looking to make an impactful difference in your work, yourself, and your community? Why settle for just a job when you can land a career? At ICW Group, we are hiring team members who are ready to use their skills, curiosity, and drive to be part of our journey as we strive to transform the insurance carrier space. We re proud to be in business for over 50 years, and its change agents like yourself that will help us continue to deliver our mission to create the best insurance experience possible. Headquartered in San Diego with regional offices located throughout the United States, ICW Group has been named for the twelfth consecutive year in a row and for the 20th time overall as a Top 50 performing P&C organization offering the stability of a large, profitable and growing company combined with a focus on all things people. It s our team members who make us an employer of choice and the vibrant company we are today. We strive to make both our internal and external communities better everyday! Learn more about why you want to be here! PURPOSE OF THE JOB The purpose of the Information Security Engineer III is to design secure architectures and develop cybersecurity approaches and techniques to protect ICW Group’s cloud, data, and/or AI-driven environments. This position will assist with strategic initiatives for short and long-term plans to identify and reduce the attack surface across applications and systems. This role partners closely with application, cloud, data, and analytics teams to ensure security is embedded into systems from design through production This role supports ICW’s modern data initiatives by reducing risk, strengthening security controls, and enabling secure adoption of new technologies in a highly regulated insurance environment. The engineer contributes across vulnerability management, threat detection, and incident response while providing practical security guidance that balances risk, compliance, and business needs. ESSENTIAL DUTIES AND RESPONSIBILITIES Monitoring, Detection, and Incident Support Monitors cloud, on-prem, and SaaS environments for security threats using SIEM, EDR, cloud-native logging, and network telemetry. Assists with security incident response activities, including investigation, containment, remediation, and post-incident analysis. Researches and implements methods to remediate network and application security vulnerabilities. Leads and participates in security architecture controls reporting, compliance audits, monthly and ad-hoc statistics and trends, and risk-focused reports including internal and 3rd party Risk Assessments. Produce risk-focused security findings and communicate clearly with technical and non-technical stakeholders. Conducts threat hunting and root-cause analysis to identify anomalous behavior, exploitation attempts, and indicators of compromise. Investigates potential data misuse, data exfiltration, and anomalous access patterns using logs, DLP, and monitoring tools. Cloud & Generalist Security Responsibilities. Prepares and analyses system security reports by collecting, analyzing, and summarizing data and trends and makes recommendations to improve security. Serve as a senior technical contributor across cloud security, including IAM, logging, monitoring, detection, and secure deployment patterns. Lead or contribute to vulnerability management across cloud infrastructure, applications, containers, and data platforms. Participate in offensive and defensive security activities, including threat modeling, red team exercises, blue team detection improvements, and threat hunting. Support incident response investigations involving cloud misconfigurations, data exposure, and/or AI-related security events. Perform security architecture reviews and provide guidance to engineering teams to reduce risk while enabling business objectives. Implement and improve security controls that strengthen ICW’s overall security posture while supporting modern cloud and data initiatives. Security Architecture, Standards, and Risk Partners with Engineering, Infrastructure, Cloud, Data, and Operations teams to embed security into system design and delivery. Lead security reviews for new data, analytics, and/or AI initiatives, including architecture reviews and risk assessments prior to production deployment. Conduct threat modeling and security design reviews for systems involving data, analytics, AI, and/or cloud services. Create and maintain technical security standards and guardrails related to data protection, cloud usage, and/or AI security. Partner with internal teams to remediate security findings and track remediation activities through closure. Provide security guidance that balances risk reduction with delivery speed and business priorities. Collaboration and Enablement Executes technical and process changes required to adopt, maintain, and adjust InfoSec controls as required to manage the company s risks and align with industry best practices. Partner with Engineering, Cloud, Data, Infrastructure, and Operations teams to embed security into system design and delivery. Act as a trusted security advisor to project teams, helping them understand risk, controls, and secure design patterns. Coach and mentor engineers on secure development, data handling, and cloud security best practices. Work closely with project management and internal stakeholders to define and implement secure, scalable solutions. Data and AI Security Design and implement security controls to protect sensitive insurance data across AWS data platforms, analytics pipelines, and AI/ML workloads. Provide security oversight for AI and LLM use cases, including model access controls, training data protection, inference security, data leakage prevention, and misuse/abuse risk. Assess and mitigate risks related to AI systems, LLM usage, prompt injection, data poisoning, third-party data sources, and emerging AI threats. Partner with Compliance and Governance teams to ensure data and AI controls align with NIST, NYDFS, PCI DSS, and California privacy regulations (CPRA/CCPA). Contribute to the development of ICW’s AI security standards, guardrails, and internal guidance as AI adoption expands across the enterprise. Support Third-Party Risk (TPR) evaluations for AI vendors, SaaS platforms, data providers, and analytics tools that process or access ICW data. Evaluate and onboard security tools and vendors related to data protection, cloud security posture, AI governance, and detection. EDUCATION AND EXPERIENCE Bachelor s Degree required in Engineering, Cybersecurity, Networking, or Computer Science related discipline. Minimum 8 years of experience working in a security engineering related role designing secure networks, systems and application architectures or equivalent combination of education and experience required. Minimum 3-5 years of experience in AWS Cloud Security services preferred. Direct experience using advanced technologies such as Intrusion Detection & Prevention Systems (IDS/IPS), Firewalls, SIEM, Antivirus software, Network Packet Analyzers, content filtering, Malware analysis and forensics tools to detect intrusions. Experience in cyber security role requiring knowledge of data analysis, risk assessment, risk mitigation, investigation methods, incident management concepts and practices, and policy and procedure development. Experience with AWS Services such as AWS Identity & Access Management, AWS Organizations, AWS Security HuB, Guard Duty, CloudTrail, AWS CloudTrail. CERTIFICATES, LICENSES, REGISTRATIONS Certification in GSEC, CISSP, and/or Security preferred. AWS Certified Security – Specialty, preferred. KNOWLEDGE AND SKILLS Knowledge of risk assessment tools, technologies, and methodologies. Knowledge of disaster recovery, computer forensic tools, technologies, and methods. Knowledge of enterprise security platforms. Ability to communicate network security issues to peers and management. Ability to read and use the results of mobile code, malicious code, and anti-virus software. Strong understanding of endpoint security solutions to include File Integrity Monitoring and Data Loss Prevention. Demonstrated experience as a lead engineer in the design, implementation and support in an enterprise IT environment. Ability to combine disparate skills and thinking to craft solutions and solve complex operational problems. Ability to hypothesize on root cause of inefficiencies and then test out probable solutions against those hypotheses. Must be able to read, write and speak English effectively. Ability to effectively communicate/present technical information to a non-technical audience. Ability to cross train and share information with team members. PHYSICAL REQUIREMENTS Office environment – no specific or unusual physical or environmental demands and employees are regularly required to sit, walk, stand, talk, and hear. Employees are required to reach with hands and arms; stoop, kneel, crouch, or crawl. Employees must occasionally lift and/or move up to 30 pounds. Employees are required to have visual acuity and be capable of operating and viewing computers and other electronic devices for extended periods of time. WORK ENVIRONMENT This position operates in an office environment and requires the frequent use of a computer, telephone, copier, and other standard office equipment. We are currently not offering employment sponsorship for this opportunity. #LI-TM1 #LI-HYBRID The current range for this position is $121,624.81 - $217,710.99 This range is exclusive of fringe benefits and potential bonuses. If hired at ICW Group, your final base salary compensation will be determined by factors unique to each candidate, including experience, education and the location of the role and considers employees performing substantially similar work. WHY JOIN ICW GROUP? Challenging work and the ability to make a difference You will have a voice and feel a sense of belonging We offer a competitive benefits package, with generous medical, dental, and vision plans as well as 401K retirement plans and company match Bonus potential for all positions Paid Time Off Paid holidays throughout the calendar year Want to continue learning? We’ll support you 100% ICW Group is committed to creating a diverse environment and is proud to be an Equal Opportunity Employer. ICW Group will not discriminate against an applicant or employee on the basis of race, color, religion, national origin, ancestry, sex/gender, age, physical or mental disability, military or veteran status, genetic information, sexual orientation, gender identity, gender expression, marital status, or any other characteristic protected by applicable federal, state or local law. ___________________ Job Category IT

Requirements

Must-haves

Monitoring, Detection, and Incident Support Monitors cloud, on-prem, and SaaS environments for security threats using SIEM, EDR, cloud-native logging, and network telemetry.
Assists with security incident response activities, including investigation, containment, remediation, and post-incident analysis.
Researches and implements methods to remediate network and application security vulnerabilities.
Leads and participates in security architecture controls reporting, compliance audits, monthly and ad-hoc statistics and trends, and risk-focused reports including internal and 3rd party Risk Assessments.
Produce risk-focused security findings and communicate clearly with technical and non-technical stakeholders.
Conducts threat hunting and root-cause analysis to identify anomalous behavior, exploitation attempts, and indicators of compromise.
Investigates potential data misuse, data exfiltration, and anomalous access patterns using logs, DLP, and monitoring tools.
Cloud & Generalist Security Responsibilities.
Prepares and analyses system security reports by collecting, analyzing, and summarizing data and trends and makes recommendations to improve security.
Serve as a senior technical contributor across cloud security, including IAM, logging, monitoring, detection, and secure deployment patterns.
Lead or contribute to vulnerability management across cloud infrastructure, applications, containers, and data platforms.
Participate in offensive and defensive security activities, including threat modeling, red team exercises, blue team detection improvements, and threat hunting.
Support incident response investigations involving cloud misconfigurations, data exposure, and/or AI-related security events.
Perform security architecture reviews and provide guidance to engineering teams to reduce risk while enabling business objectives.
Implement and improve security controls that strengthen ICW’s overall security posture while supporting modern cloud and data initiatives.
Security Architecture, Standards, and Risk
Partners with Engineering, Infrastructure, Cloud, Data, and Operations teams to embed security into system design and delivery.
Lead security reviews for new data, analytics, and/or AI initiatives, including architecture reviews and risk assessments prior to production deployment.
Conduct threat modeling and security design reviews for systems involving data, analytics, AI, and/or cloud services.
Create and maintain technical security standards and guardrails related to data protection, cloud usage, and/or AI security.
Partner with internal teams to remediate security findings and track remediation activities through closure.
Provide security guidance that balances risk reduction with delivery speed and business priorities.

Nice-to-haves

Certification in GSEC, CISSP, and/or Security preferred. AWS Certified Security – Specialty, preferred.
Bonus potential for all positions

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aiawsmlllm

Platform: workday
Effort: long

Benefits

Benefits detected in the listing.

Dental

Vision

401k

Paid Time Off