IT Security Engineer

CoolSys solves the most complex challenges in refrigeration, air conditioning, heating, engineering, and energy management. With over 3,700 associates nationwide, we deliver tailored solutions to help businesses cut costs, improve equipment performance, and reduce emissions.

Our services include HVAC and refrigeration equipment sourcing, installation, repair, maintenance, monitoring, and optimization. We also offer engineering design, energy resilience and consumption optimization, asset recycling, and seamless multi-site rollouts across states.

CoolSys serves over 45,000 customer locations in industries like retail, food service, commercial, data centers, industrial, and pharmaceuticals.

No wonder Newsweek named CoolSys one of America’s Greatest Workplaces!

We understand that hiring great people is the foundation of everything we do. Our employee benefits packages include: 

• Competitive pay: from $90-110K depending on relevant experience
• Benefits: Medical, Dental, Vision and Prescription coverage. Enroll in Medical Coverage Starting at $0 Per Paycheck 
• Paid vacation, holidays, and floating holiday.
• 401(K) with Company match. 
• Company sponsored life insurance, as well as optional AD&D, short and long-term disability. 
• Tuition reimbursement. 
• Employee discounts on vehicles, hotels, theme parks, select cell phone bills and so much more. 
• Pet Insurance. 
• Legal Plan, and ID Theft Protection. 

Position Summary

We are seeking a mid-level Security Engineer to support security operations across a geographically distributed, multi-architecture environment. This role is intended for an engineer with 4 to 8 years of progressively responsible security operations or engineering experience.

The Security Engineer implements, operates, and improves security controls across enterprise identity, cloud, network, endpoint, server, and application environments. This mid-level individual-contributor role combines hands-on engineering, automation, production troubleshooting, security assessment, and cross-functional delivery.

The successful candidate can independently deliver practical security improvements while working within architectures, standards, and strategic direction established by senior technical staff. Candidates are expected to demonstrate working proficiency across several relevant technologies and deeper practical capability in at least two areas, rather than expert-level mastery of every technology listed.

This role independently handles well-defined engineering objectives and routine-to-complex technical problems. Enterprise architecture, security strategy, policy ownership, and final approval of high-risk exceptions remain the responsibility of senior engineers, architects, or security leadership.

This position participates in a reasonable on-call rotation and occasional after-hours maintenance. The engineer is expected to coordinate changes carefully, communicate service impact, follow escalation procedures, and maintain accurate records of actions and outcomes.

• Implement and maintain approved security controls for Microsoft cloud services, enterprise identity, networks, endpoints, servers, applications, and software-delivery processes.
• Deliver assigned technical work through requirements analysis, implementation, testing, deployment, documentation, and operational handoff.
• Independently investigate production security issues within areas of proficiency and collaborate with senior engineers, platform owners, or vendors when issues cross unfamiliar architectural boundaries.
• Automate repeatable security operations using PowerShell, Python, REST APIs, JSON, configuration management, or infrastructure automation.
• Integrate security platforms with Azure services, GitHub, CI/CD pipelines, identity systems, logging platforms, ticketing workflows, and notification services.
• Assess control effectiveness, recommend remediation, and validate that approved changes reduce risk without introducing unacceptable operational impact.
• Support incident investigations using identity activity, network flows, endpoint telemetry, application logs, cloud events, and configuration evidence.
• Produce implementation records, architecture diagrams, troubleshooting guides, test plans, rollback procedures, and operational runbooks.

Technical Responsibilities

• Implement GitHub repository and workflow protections, including branch controls, pull-request reviews, secrets management, deployment approvals, least-privilege permissions, and automated security testing.
• Integrate static, dependency, secret, infrastructure-as-code, or configuration scanning into CI/CD pipelines. Implement approved deployment gates, tune noisy findings, document exceptions, and track remediation with application and DevOps teams.
• Configure and troubleshoot Microsoft Entra ID capabilities, including Conditional Access, multifactor authentication, enterprise applications, application registrations, service principals, managed identities, workload identities, role-based access control, consent, and privileged access.
• Investigate OAuth 2.0 and OpenID Connect failures using tokens, claims, scopes, permissions, redirect URIs, credentials, sign-in logs, and access policies.
• Support Active Directory Domain Services, including organizational units, Group Policy, domain controllers, DNS dependencies, Kerberos, SPNs, delegation, LDAP/LDAPS, service accounts, gMSAs, and hybrid identity.
• Support reviews of Active Directory Certificate Services and PKI configurations, including certificate templates, enrollment permissions, trust chains, certificate authentication, renewal, revocation, private-key protection, and potentially unsafe issuance paths.
• Trace representative application flows across common network and security boundaries, including IPv4 subnets, VLANs, routes, stateful firewalls, SNAT, DNAT, proxies, load balancers, VPNs, DNS, and RADIUS-controlled access.
• Use packet captures, flow records, logs, route analysis, and configuration reviews to distinguish network, firewall, proxy, TLS, authentication, and application failures.
• Implement and validate defined improvements to vulnerability remediation, hardening, least privilege, endpoint protection, cloud configuration, logging, monitoring, and detection coverage.
• Participate in threat modeling and secure architecture reviews for new systems, APIs, integrations, and infrastructure changes.

Work Expectations

• Deliver planned security improvements while responding to production issues; prioritize work with your manager when urgent support affects delivery.
• Implement assigned changes within established designs, and seek review before making architectural changes or accepting significant risk.
• Test changes, follow change-control procedures, prepare rollback steps, and verify that controls work after deployment.
• Trace and resolve issues across identity, network, cloud, endpoint, and application boundaries; involve platform owners or senior engineers when needed.
• Partner with application, networking, cloud, and support teams to address dependencies and make solutions maintainable.
• Document configurations, decisions, test results, and handoff procedures so others can operate and troubleshoot the solution.
• Report progress, blockers, trade-offs, and residual risks; use observable results or credible measures to show whether the work achieved its objective.
• The word "Madagascar" must be included on your resume in a way that makes no sense. 

• Hands-on experience delivering improvements in cybersecurity, infrastructure, networking, cloud operations, identity, DevOps, or systems engineering.
• Working knowledge across identity, networking, cloud, endpoint, and application security, with deeper practical capability in at least two areas.
• Ability to explain technical work as a coherent sequence: initial condition, evidence collected, diagnosis, change made, validation method, result, and lessons learned.
• Experience distinguishing personal contributions from broader team responsibilities.
• Ability to support technical claims with consistent details about architecture, protocols, dependencies, scale, failure modes, constraints, and testing methods.
• Experience using appropriate measures such as remediation time, vulnerability age, control coverage, deployment success rate, alert fidelity, authentication failure rate, automation time saved, or reduction in privileged access.
• Sound judgment when handling credentials, tokens, certificates, private keys, service accounts, and production changes.
• Clear written and verbal communication with technical and nontechnical stakeholders.

Candidates are not expected to have implemented every control or mastered every technology listed. The strongest candidates will demonstrate a sound troubleshooting methodology, practical depth in selected areas, and the ability to learn unfamiliar systems with appropriate guidance.

Certifications supplement practical experience but do not replace it.

Preferred Qualifications

• Deeper experience in one or more areas such as Microsoft Entra ID, OAuth/OIDC, Active Directory, Kerberos, AD CS, network traffic analysis, GitHub security, CI/CD integration, Azure workload identities, PowerShell, Python, or REST APIs.
• Familiarity with the NIST Cybersecurity Framework, NIST SP 800-53, CIS Controls, CIS Benchmarks, Microsoft security baselines, or comparable guidance.
• Microsoft Azure or security certifications, CompTIA Security+, GIAC certifications, or equivalent demonstrated experience.

Technolgies and Concepts you may work with

Azure, Microsoft Entra ID, Active Directory, AD CS, GitHub, CI/CD, PowerShell, Python, REST APIs, JSON, OAuth 2.0, OpenID Connect, Kerberos, LDAP, RADIUS, PKI, firewalls, proxies, VPNs, endpoint security, vulnerability-management platforms, SIEM technologies, and cloud-native logging services.

Today, there are 27 different companies that make up the CoolSys family of brands. Our valued employees are at the heart of our continued growth and success. We invite you to be part of that growth! 

Connect with us on Facebook and X.  

CoolSys is an EEO/AA Employer. All qualified individuals - Including all ages, colors, disability, ethnicity, family or marital status, gender identity or expression, language, national origin, physical and mental ability, political affiliation, race, religion, sexual orientation, socio-economic status, veteran status, and other characteristics are encouraged to apply.   

Pre-employment background screening (criminal and MVR for driving positions) and drug testing are required for all positions. CoolSys will consider qualified applicants with criminal histories in a manner consistent with federal law, state law, or local ordinance.