Senior Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Collaborate with Engineering and Product teams throughout the entire development lifecycle, starting from early design and threat modeling to launch and continuous operation.

• Conduct security assessments of system architectures, application code, APIs, infrastructure as code, cloud environments, Kubernetes workloads, deployment pipelines, and production settings.

• Detect vulnerabilities and design flaws, communicate their impact, and collaborate with engineers on rectification efforts.

• Act as a security subject-matter expert in areas such as application security, cloud and container security, IAM, secrets management, API security, data protection, and secure software development practices.

• Create reusable security guidelines, secure design patterns, review checklists, and engineering standards.

• Manage and enhance security tools, including AI-assisted solutions, SAST, DAST, SCA, container and IaC scanning, CSPM, and security monitoring systems.

• Embed security measures within developer workflows and CI/CD pipelines; fine-tune rules, minimize false positives, enhance coverage, and ensure actionable findings.

• Convert threat models and attack vectors into requirements for logging, monitoring, and detection.

• Identify gaps in telemetry across application, cloud, identity, infrastructure, and blockchain security, collaborating with engineering teams to resolve these issues.

• Design, implement, test, document, and refine security alert rules and detection logic.

• Respond to and investigate security alerts, correlating activities across various data sources to ascertain scope, impact, severity, and necessary actions.

• Collaborate with the SOC to enhance alert quality, escalation protocols, investigative procedures, and response playbooks.

• Engage in incident response activities, including investigation, containment, eradication, recovery, coordination, and evidence preservation.

• Lead or support post-incident reviews and implement sustainable improvements.

• Manage day-to-day vulnerability management processes, including intake, validation, prioritization, assignment, remediation tracking, exceptions, verification, and reporting.

• Assist with third-party penetration tests, code reviews, architectural evaluations, and independent security assessments.

• Evaluate the security implications of new vendors, technologies, integrations, and architectural modifications.

• Develop automation and metrics to enhance security visibility and expedite investigation and remediation efforts.

• Contribute to product security, platform security, detection engineering, vulnerability management, and incident-readiness roadmaps.

⛳️ Requirements

• Over 5 years of practical experience in product security, application security, cloud security, or a closely related security engineering position.

• Strong foundational knowledge in software engineering with the ability to review application code; familiarity with TypeScript, Node.js, JavaScript, or another modern programming language is particularly beneficial.

• Experience in reviewing web applications, backend services, REST APIs, and systems for authentication and authorization, as well as relational database designs.

• Working knowledge of common application and API vulnerabilities, threat modeling techniques, secure design principles, and modern identity patterns.

• Experience in securing AWS environments, containerized applications, Kubernetes, infrastructure as code, and CI/CD or GitOps workflows.

• Practical experience in implementing or managing SAST, DAST, SCA, CSPM, container scanning, secrets detection, infrastructure-as-code scanning, SIEM, or cloud-native detection systems.

• Experience in developing or fine-tuning security detections using various telemetry sources, including application, cloud, identity, network, and infrastructure data.

• Strong investigative skills, encompassing log and system activity analysis, hypothesis development and testing, timeline establishment, and scope and impact determination.

• Experience collaborating with SOC teams, particularly in alert escalation, investigation handoffs, runbook creation, and detection quality enhancement.

• Experience in security incident response, coordinating with engineering and operational teams under time constraints.

• Proficient in managing a vulnerability management process and driving remediation efforts across multiple engineering teams.

• Ability to assess findings and detections based on exploitability, confidence levels, and business impact.

• Experience working with external penetration testers, auditors, or specialized security reviewers.

• Excellent written and verbal communication skills.

• High level of autonomy and sound judgment.

• Collaborative and low-ego approach to security.

• Preferred: experience in securing fintech, payment systems, digital assets, or high-assurance financial platforms.

• Preferred: knowledge of blockchain systems, smart contract integrations, transaction flows, custody models, signing infrastructure, or cryptographic key management.

• Preferred: experience with TypeScript, Pulumi, AWS, Argo CD, Cloudflare, PostgreSQL, Prometheus, or Grafana.

• Preferred: familiarity with incident response tools, security data pipelines, log normalization, detection-as-code, or automated enrichment and response mechanisms.

• Preferred: experience in defining operational security metrics.

• Preferred: ability to design security controls for distributed, event-driven, multi-tenant, or high-availability systems.

• Preferred: capability to create security automation, internal tools, or CI/CD integrations using code.

• Preferred: experience utilizing AI-assisted tools for security investigations, detection engineering, or secure software development.

• Preferred: relevant offensive security, incident response, and cloud security experience or certifications.

🏝️ Benefits

• Comprehensive health, dental, and vision insurance.

• Flexible work hours and remote work options.

• Generous paid time off and holiday policies.

• Professional development opportunities and training reimbursements.

• Collaborative work environment with a focus on innovation and continuous improvement.