Senior Security Engineer

About the Company

Redwood Trust, Inc. (NYSE: RWT), together with its subsidiaries, is a specialty finance company focused on investing in mortgage related assets, and engaging in residential and commercial mortgage banking activities. Our employees are a team of disciplined, dedicated and talented professionals who do what it takes to make the Company a leader in innovation and reputation. We value everyone's contribution, actively soliciting feedback at all levels within the organization. Work gets done in a non-hierarchical, hard-working and fun environment.

For more information about our Company, please look up the Redwood Review, published quarterly, available on our website www.redwoodtrust.com.

About the Role

The Sr. Security Engineer is responsible for cybersecurity design, implementation, and maintenance in alignment to business initiatives. The individual acts as a senior technical resource and escalation point across security operations, threat identification and remediation, and incident response, and works hands-on across identity, endpoint, network, cloud, email, and data protection.

Redwood’s environment spans Azure, Microsoft 365, and a remaining on-premises footprint, and increasingly includes AI-driven products and services built on Azure AI Foundry and Microsoft Fabric. This engineer secures all of it. Experience with AI and machine learning systems matters here because those workloads touch borrower information and material financial data, though this role covers the full breadth of the security engineering function rather than a single specialty.

The successful candidate works closely with infrastructure engineering, application development, data, and database teams to embed security into how systems are built and operated, and with decision makers to identify, recommend, develop, implement, and support cost-effective security solutions. The security program at Redwood is being built out deliberately rather than inherited, so this role carries real influence over the standards and tooling we adopt.

Responsibilities

• Design, implement, and maintain security controls across identity, endpoint, network, cloud, email, and data protection, with emphasis on the Microsoft security stack including Entra ID, Defender, Sentinel, Purview, and Intune.
• Analyze, evaluate, and document security risks across cloud, on-premises, and AI or machine learning applications, and recommend controls proportionate to the risk.
• Operate and tune the SIEM, build and maintain detections, and work alerts through to resolution.
• Participate in incident response, coordinating investigation, containment, remediation, and post-incident analysis, and act with a sense of urgency when reacting to incidents and vulnerabilities.
• Conduct vulnerability scanning and testing, document findings, and drive remediation with infrastructure, application, and database teams.
• Contribute to Identity and Access Management architecture and standards, including provisioning and deprovisioning processes, periodic access reviews, conditional access, and privileged access.
• Embed security into delivery through pipeline controls, infrastructure as code guardrails, secrets management, and secure configuration baselines.
• Secure AI and machine learning workloads alongside the rest of the environment, including model APIs, data pipelines, and the controls around copilot and agent deployments, and monitor for adversarial threats such as prompt injection, data poisoning, and model extraction.
• Perform third-party and vendor security assessments, including questionnaire review, risk findings, and remediation tracking, and evaluate new services and AI features before adoption.
• Integrate security monitoring across tools and platforms, and leverage automation and AI to assist with SOAR, incident response, and monitoring.
• Develop metrics, dashboards, and reporting for key security technologies, including Key Performance Indicators and Key Risk Indicators.
• Contribute to security policies, standards, and runbooks aligned to the NIST Cybersecurity Framework, and keep them current as the environment changes.
• Support control and regulatory obligations including SOX IT general controls, GLBA safeguards, NYDFS Part 500, and SEC cyber disclosure readiness.
• Provide training and guidance to engineering teams on secure development and secure AI practices.
• Support day-to-day coordination with outsourced security vendors and the managed security service provider.
• Participate in the after-hours on-call rotation for incident response.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, Data Science, or a related field, or equivalent experience.

Required Skills

• Six or more years in cybersecurity roles spanning security engineering, security operations, or application security.
• Hands-on experience operating a SIEM, building detections, and working real incidents through to resolution and lessons learned.
• Experience with core cybersecurity tooling including SIEM, endpoint protection, IAM, encryption, email security, and IDS or IPS.
• Solid cloud security foundations on Azure, including identity and access management, network controls, and native security tooling.
• Experience securing AI or machine learning systems, including familiarity with adversarial concepts such as prompt injection, data poisoning, model extraction, and data integrity attacks.
• Understanding of cloud-based AI platforms such as Azure AI Foundry, Azure OpenAI, or Microsoft Copilot, and the risks introduced by agent and retrieval augmented generation architectures.
• Practical vulnerability management experience, including scanning, prioritization, and driving remediation across teams.
• Scripting and automation ability in PowerShell, Python, or similar, with enough familiarity with CI/CD and infrastructure as code to build controls into pipelines.
• Familiarity with NIST and CIS frameworks, and awareness of emerging AI security guidance such as NIST AI RMF and the OWASP Top 10 for LLM applications.
• Experience analyzing and documenting security solutions and mapping them to business requirements.
• Ability to set and change priorities amongst multiple competing constituencies.
• Ability to collaborate across technical and non-technical teams and explain complex security topics clearly.

Preferred Skills

• Experience in financial services, mortgage, or another regulated industry.
• Hands-on adversarial testing of LLM or agentic applications, including use of tools such as PyRIT, Garak, or Promptfoo.
• Penetration testing or red teaming background.
• Detection engineering experience in Sentinel or a comparable SIEM, and experience building cybersecurity runbooks.
• Knowledge of secure API design and authentication mechanisms.
• Experience