Security Engineer

• Implement and maintain security controls across infrastructure, applications and internal systems
• Close compliance gaps as they are identified
• Enforce information security policies across engineering and business teams
• Manage access control, data classification, incident response, vendor risk and change management practices
• Perform recurring access reviews, log reviews, vulnerability scans and patch cadence checks
• Organize audit evidence
• Triage vulnerability scanner findings, coordinate remediation with engineering and verify closure
• Manage onboarding, offboarding, least-privilege access, MFA enforcement and periodic access recertification
• Monitor security alerts and logs; triage and escalate incidents according to the incident response plan
• Maintain the risk register and third-party risk assessments; track remediation to closure
• Prepare evidence for annual assessments and respond to customer security questionnaires
• Run employee security training and phishing simulations
• Partner with engineering on AWS IAM, encryption at rest and in transit, and secrets management
• Work cross-functionally with Security and Engineering teams across time zones

• 2–5 years in security engineering, cloud security or infrastructure security
• Ideally direct SOC 2 or ISO 27001 exposure
• Working knowledge of the SOC 2 Trust Services Criteria and mapping technical controls to them
• Hands-on AWS cloud security fundamentals, including IAM, logging/monitoring and vulnerability scanning
• Experience executing access reviews, evidence collection and remediation tracking
• Clear written communication
• Comfortable working asynchronously across time zones with a distributed team
• Familiarity with GRC automation platforms such as Vanta or Drata is highly valued
• Relevant certification such as Security+, CySA+, ISO 27001 Lead Implementer, or progress toward CISA/CISSP is highly valued

• Competitive compensation
• Flexible hours
• Fully remote work
• Global, distributed team environment
• Real ownership over security controls protecting customer data
• Multi-framework exposure to SOC 2 and ISO 27001 programs