Want to know if this job is worth applying to?
Área Metropolitana de San José, Costa Rica
Hybrid
Syniverse is the world’s most connected company. Whether we’re developing the technology that enables intelligent cars to safely react to traffic changes or freeing travelers to explore by keeping their devices online wherever they go, we believe in leading the world forward. Which is why we work with some of the world’s most recognized brands. Eight of the top 10 banks. Four of the top 5 global technology companies. Over 900 communications providers. And how we’re able to provide our incredible talent with an innovative culture and great benefits.
Who We're Looking For
This position is responsible for analyzing, developing, testing, and supporting security implementations. These security implementations must be developed and maintained with high-quality standards and minimal defects. This role will also act as a mentor and leader to other teammates and as a support for management.-
Some of What You'll Do
Scope of the Role:
Key Responsibilities:
· Own the security architecture, hardening, and risk remediation strategy for Syniverse’s Windows Server and Windows endpoint estate, including Active Directory, Group Policy, DNS, certificate services, and related infrastructure.
· Design and maintain secure baseline configurations (CIS Benchmarks) for Windows systems, and drive compliance through configuration management tooling
· Partner with the Counter Adversary Team to validate control effectiveness, and drive remediation of findings related to Windows, and data security.
· Investigate and support the response to Windows and endpoint- related security incidents, including forensic triage, containment, and root- cause analysis, in coordination with the SOC and EDR platform (CrowdStrike Falcon Complete).
· Develop automation (PowerShell, Python, or similar) to reduce manual security operations work — hardening checks, log onboarding, compliance evidence collection, and remediation workflows.
· Design, deploy, and operate DLP controls across endpoints, email, and cloud channels to prevent unauthorized exfiltration of sensitive and regulated data (PII, customer data, intellectual property).
· Implement and mature DSPM capabilities to discover, classify, and monitor sensitive data across on- premises Windows file systems, databases, and cloud repositories, and translate findings into risk- prioritized remediation plans.
· Contribute Windows, Splunk, and data- security subject matter expertise to threat modeling, architecture reviews, and Security Risk Acceptance (SRA) evaluations for new and changing systems.
· Mentor other security engineers on Windows security and Splunk engineering practices, and act as an escalation point for complex technical issues.
· Maintain clear technical documentation and runbooks and communicate risk and remediation status effectively to both technical peers and non- technical stakeholders.
· Build, tune, and maintain Splunk detections, correlation searches, dashboards, and lookups covering Windows security telemetry (event logs, Sysmon, EDR, Active Directory audit data), partnering with SOC and Detection Engineering to close coverage gaps.
· Author and maintain Splunk SPL content — alerts, scheduled searches, and lookup- generating pipelines — to support threat detection, compliance reporting, and operational dashboards for the Windows and endpoint environment.
Required Qualifications:
· Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent professional experience.
· 8+ years of progressive experience in information security or systems engineering, with at least 5 years focused specifically on Windows security engineering or Windows infrastructure hardening.
· Deep expertise in Windows Server and Active Directory security: Group Policy, Kerberos/NTLM, PKI, and common attack paths (e.g., lateral movement, credential theft, Kerberoasting).
· Proficient across the Microsoft security and cloud suite, including Entra ID (Azure AD), Microsoft Defender (Endpoint/XDR), Microsoft Purview (DLP/Information Protection), and Azure infrastructure and security services.
· Hands- on proficiency with Splunk, including SPL query authoring, correlation searches, scheduled alerts/lookups, and dashboard or Dashboard Studio development.
· Practical experience implementing or operating DLP solutions (e.g., Microsoft Purview DLP, Zscaler DLP/DSLPM or equivalent) across endpoint, network, and cloud channels.
· Working knowledge of DSPM platforms and practices — data discovery, classification, and risk scoring across structured and unstructured data stores.
· Experience with endpoint detection and response (EDR) platforms (e.g., CrowdStrike) and applying CIS Benchmarks to harden Windows systems.
· Scripting/automation ability in PowerShell and at least one additional language (Python preferred).
· Solid understanding of Zero Trust principles, identity- centric security architecture, and modern threat frameworks (MITRE ATT&CK).
· Strong written and verbal communication skills, with the ability to translate technical risk into business terms for leadership and cross- functional partners.
Preferred Qualifications:
· Relevant certifications such as GCWN, CISSP, CRTP/CRTE, CompTIA Sec+ or Microsoft SC- 100/SC- 400.
· Familiarity with hybrid identity (Azure AD/Entra ID) alongside on- premises Active Directory.
· Exposure to threat modeling methodologies, coverage- matrix based risk assessment, or formal security risk acceptance processes.
· Prior experience mentoring engineers or leading technical workstreams without formal people- management authority.
Additional Requirements:
· Excellent oral and written communication skills
· Excellent analytical and problem- solving skills
· Constant improving mindset and ability to identify repetitive processes and automation opportunities
· Innovative and creative when solving issues
· Able to work in a fast- paced environment with little supervision
· Basic knowledge of multiple security frameworks
· Basic knowledge of security design and testing principles
· Knowledge of log aggregation and event correlation strategies
· Background in the telecommunications industry is a good- to- have
What Success Looks Like:
● Windows attack surface (identity, endpoint, and infrastructure) is measurably reduced through hardening, patching discipline, and privileged- access controls.
● Splunk detection coverage for Windows and identity- based threats is comprehensive, well- tuned, and actionable for SOC.
● DLP and DSPM programs provide reliable visibility into where sensitive data lives and how it moves, with findings driving prioritized remediation.
● Peers and partner teams regard this role as the go- to technical authority on Windows security within the Cybersecurity organization.
#LI-Hybrid
-
Why You Should Join Us
Join us as we write a new chapter, guided by world-class leadership. Come be a part of an exciting and growing organization where we offer a competitive total compensation, flexible/remote work and with a leadership team committed to fostering an inclusive, collaborative, and transparent organizational culture.
At Syniverse connectedness is at the core of our business. We believe diversity, equity, and inclusion among our employees is crucial to our success as a global company as we seek to recruit, develop, and retain the most talented people who want to help us connect the world.
Know someone at Syniverse?
Be sure to have them submit you as a referral prior to applying for this position.
Pay Transparency
In accordance with applicable pay transparency requirements, Syniverse will provide information regarding the salary range or compensation for this position during the recruitment process and prior to any compensation discussions.