Candidates should be able to work East Coast Hours.

About you and the role:

The Cybersecurity Assurance Specialist provides independent, technically informed assurance over Enstar's cybersecurity tools, controls and operational processes. The role plans and performs risk-based reviews to determine whether controls are appropriately designed, configured, implemented and operating effectively.Providing expertise in network and infrastructure security and translates evidence-based observations into clear findings and practical recommendations for Cybersecurity, Technology and senior management.

The role also coordinates assurance activities with third-party staff.

What you will be doing:

Key Accountabilities / Deliverables

Assurance Planning and Delivery

• Plan and deliver risk-based assurance reviews of cybersecurity tools, technical controls and operational processes in accordance with the agreed assurance plan.

• Define the objective, scope, control criteria, evidence requirements, sampling approach and test procedures for each assurance review.

• Review architecture and data-flow diagrams, technical configurations, policies, procedures, inventories, dashboards, alerts, logs, tickets and exceptions to form evidence-based conclusions.

• Assess both control design and operating effectiveness, clearly distinguishing between the existence of a security tool and the protection achieved through its configuration, coverage and operation.

Technology Asset and Software Governance

• Assess the governance, completeness and accuracy of technology asset inventories across endpoints, servers, network devices, applications and cloud resources; reconcile authoritative sources, ownership, lifecycle status and security-tool coverage, and investigate unmanaged, stale, duplicate or unknown assets.

• Review software installed across the environment against approved standards and business need; assess governance, ownership, licensing, version currency and lifecycle status, and identify unauthorized, obsolete, unsupported or end-of-life and end-of-support software for remediation.

• Network and Infrastructure Assurance

• Perform network and infrastructure assurance covering TCP/IP, ports and protocols, routing, subnets, CIDR, firewalls, access-control lists, proxies, NAT, VPNs, remote access, public exposure and IP allowlisting.

• Evaluate network segmentation, trust boundaries and data flows between users, servers, applications, cloud environments, management networks and sensitive systems, and validate that implemented segmentation achieves its intended security outcome.

• Assess DNS architecture and controls, including name resolution, domain and subdomain management, DNS records, filtering, external exposure and common DNS-related risks.

• Review encryption controls for data at rest and in transit, including TLS, certificates, approved protocols, key management, ownership, rotation and documented exceptions.

Security Tool and Platform Assurance

• Assess Palo Alto GlobalProtect and Prisma Access controls, including remote-access configuration, security policies, application and URL controls, routing, logging, monitoring and policy exceptions.

• Assess CrowdStrike Falcon Complete, including sensor deployment and health, prevention policies, detections, managed response, host containment, exclusions, vulnerability exposure and escalation processes.

• Assess Microsoft Intune, including device enrolment, the accuracy and effectiveness of device compliance checks, configuration and compliance policies, application protection, encryption, patch and security control status, exceptions, reporting and integration with Conditional Access.

• Assess CyberArk, including privileged-account onboarding, vaulting, credential rotation, session management, monitoring, reconciliation, break-glass access and coverage reporting.

• Assess Microsoft Azure security and networking controls, including identity, virtual networks, subnets, peering, private and public endpoints, network security groups, storage security, encryption, logging and privileged access.