Principal Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Directly report to the Chief Information Security Officer (CISO), gaining executive-level exposure and experience across various departments.

• Design, develop, and sustain a comprehensive security architecture for critical infrastructure, data, and applications.

• Create, implement, and oversee security controls and countermeasures for IT and Product Cloud infrastructures.

• Work collaboratively with Product, Engineering, development, operations, and security teams to weave security best practices into business processes, the Software Development Life Cycle (SDLC), and Continuous Integration/Continuous Deployment (CI/CD) pipelines.

• Spearhead proactive threat defense and incident response initiatives.

• Mentor SecOps engineers and offer guidance on security best practices.

• Formulate and execute security policies, standards, procedures, and training programs for employees.

• Conduct security assessments, code reviews, and penetration testing activities.

• Design and establish security controls for Infrastructure as Code (IaC), cloud environments, and containerized applications.

• Automate security testing and compliance verification using scripting and configuration management tools.

• Create and implement automated monitoring and logging mechanisms throughout development and deployment pipelines.

• Monitor and assess security events, suspicious activities, indicators of compromise, logs, network traffic, and system settings.

• Investigate incidents, evaluate scope and impact, identify root causes, and determine the extent of any compromises.

• Ensure compliance with PCI DSS, HIPAA, SOC 2, and other relevant security frameworks.

• Collaborate with senior leadership to prioritize security initiatives and manage resource allocation.

⛳️ Requirements

• A minimum of 10 years of experience in information security, demonstrating a successful track record in a similar role.

• Extensive knowledge of security principles, technologies, and methodologies (e.g., firewalls, intrusion detection/prevention systems, encryption, Identity and Access Management (IAM)).

• Thorough understanding of DevOps principles, methodologies, and tools.

• Practical experience with cloud platforms (e.g., AWS, Azure, GCP), containerization technologies (e.g., Docker, Kubernetes), and Infrastructure as Code (IaC) tools.

• Proficient in scripting languages such as Python, PowerShell, or Bash.

• Familiarity with compliance standards, including PCI DSS, SOC II, and ISO27001.

• Exceptional communication, collaboration, and problem-solving abilities.

• Knowledge of secure software development frameworks (e.g., OWASP).

• Experience with implementing security measures in Agile and DevOps environments.

• Bachelor's degree in Computer Science, Information Security, or a related field (or equivalent experience).

• Security certifications such as CISSP, CISM, or AWS Certified Security Specialty.

• Extensive experience with the following technologies: Cloudflare, Crowdstrike, Proofpoint, CyberArk EPM, BurpSuite, Amazon Security Hub, Guard Duty, Inspector, JumpCloud, and Snyk.

• Experience in developing security budgets.

• Applicants must be authorized to work in the United States; employment visa sponsorship is not available.

🏝️ Benefits

• Medical, dental, and vision coverage starting from day one — no waiting period.

• 401(k) plan with company matching and immediate vesting.

• Employee Stock Purchase Plan — purchase Cars.com stock at a discounted rate.

• Unlimited Flex Time Off, along with 11 paid holidays and 1 volunteer day.

• Paid parental and caregiver leave.

• A one-time home office stipend of $350 plus $70/month for virtual-first work.

• Tuition reimbursement available up to $5,250 per year.