{"id":3072112,"url":"https://alion.io/job/cinc-systems-security-engineer","title":"Security Engineer","company":{"id":2460684,"name":"CINC Systems","domain":"cincsystems.com","url":"https://alion.io/company/cincsystems","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Paycor","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"remote","remote_scope":"worldwide","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon CloudWatch","optional":false},{"name":"Amazon EC2","optional":false},{"name":"Amazon ECS","optional":false},{"name":"Amazon EKS","optional":false},{"name":"Amazon S3","optional":false},{"name":"Amazon SageMaker","optional":false},{"name":"API Gateway","optional":false},{"name":"AWS","optional":false},{"name":"AWS Bedrock","optional":false},{"name":"AWS CDK","optional":false},{"name":"AWS Lambda","optional":false},{"name":"Bitbucket","optional":false},{"name":"C#","optional":false},{"name":"CI/CD","optional":false},{"name":"CloudFormation","optional":false},{"name":"CWE","optional":false},{"name":"Function Calling","optional":false},{"name":"Helm","optional":false},{"name":"IAM","optional":false},{"name":"JavaScript","optional":false},{"name":"Jenkins","optional":false},{"name":"Kotlin","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"SQL","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"Agentic Workflows","optional":true},{"name":"AI Agents","optional":true},{"name":"Burp Suite","optional":true},{"name":"Checkmarx","optional":true},{"name":"Checkov","optional":true},{"name":"CIS Benchmarks","optional":true},{"name":"CodeQL","optional":true},{"name":"Dependabot","optional":true},{"name":"Fortify","optional":true},{"name":"Gitleaks","optional":true},{"name":"Grype","optional":true},{"name":"ISO 27001","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"OWASP ZAP","optional":true},{"name":"PCI DSS","optional":true},{"name":"Prisma Cloud","optional":true},{"name":"Prowler","optional":true},{"name":"RAG","optional":true},{"name":"ScoutSuite","optional":true},{"name":"Semgrep","optional":true},{"name":"Snyk","optional":true},{"name":"SOC 2","optional":true},{"name":"STRIDE","optional":true},{"name":"Syft","optional":true},{"name":"tfsec","optional":true},{"name":"Trivy","optional":true},{"name":"Veracode","optional":true},{"name":"Wiz","optional":true}],"status":"live","first_seen_at":"2026-10-22T09:43:28Z","employer_posted_date":"2026-10-22","last_verified_at":"2026-10-22T17:24:18Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Security Engineer\nLocation: Worldwide (Remote-first / Hybrid optional)\nReports to: Principal Engineer, Platform\nAbout CINC Systems\nCINC Systems is the leading provider of accounting and management software for the community association management industry. Our platform powers tens of thousands of associations and millions of homes through secure, reliable, and increasingly intelligent software systems.\nWe are evolving our platform into an AI enabled ecosystem that combines modern SaaS architecture, operational workflows, communications, payments, analytics, and automation into a unified customer experience. This transformation requires engineers who are equally comfortable designing enterprise systems, working directly with business workflows, and leveraging AI to accelerate software development and product capabilities.\nThe systems we build are increasingly interconnected and AI enabled. Success in this environment requires more than coding ability alone. It requires judgment, systems thinking, customer understanding, and the ability to integrate modern AI capabilities into practical enterprise software.\nRole Overview\nWe are looking for a highly technical Security Engineer with deep experience across application security, AWS cloud security, offensive security, secure SDLC, threat modeling and AI security. This role is suited for someone who can operate at both the engineering and adversarial levels by reviewing architecture, testing applications, identifying exploitable weaknesses, automating security workflows, securing AWS infrastructure and helping product teams build resilient systems.\nThe ideal candidate has hands-on experience with SAST, DAST, SCA, manual application security testing, AWS security reviews, red teaming, SIEM-driven detection workflows, infrastructure-as-code security and security automation. They should be comfortable working directly with engineering teams while also thinking like an attacker to uncover realistic abuse paths across applications, APIs, AWS services, CI/CD pipelines and AI-enabled systems.\nKey Responsibilities\nLead security reviews for web applications, APIs, microservices, AWS workloads, internal platforms and AI-enabled products. \nPerform advanced application security testing using SAST, DAST, SCA, manual code review, API testing and business logic testing. \nIdentify vulnerabilities across authentication, authorization, session management, access control, injection, SSRF, deserialization, insecure file handling, data exposure and insecure API design. \nConduct threat modeling for new products, critical features, AWS architectures, AI workflows, identity systems and high-risk data flows. \nBuild and improve secure SDLC processes, including security requirements, code scanning, dependency review, CI/CD security gates and release risk assessments. \nReview infrastructure-as-code templates such as Terraform, CloudFormation, AWS CDK, Helm charts and Kubernetes manifests for security misconfigurations. \nAssess AWS environments for IAM weaknesses, exposed services, insecure networking, public S3 buckets, secrets leakage, logging gaps, encryption issues, workload risks and privilege escalation paths. \nReview AWS IAM policies, roles, trust relationships, permission boundaries, service control policies, identity federation and cross-account access patterns. \nAssess AWS services such as EC2, S3, Lambda, ECS, EKS, RDS, API Gateway, CloudFront, WAF, KMS, Secrets Manager, Systems Manager, ECR, VPC, Route 53 and IAM Identity Center. \nConduct red team exercises, adversary simulations, attack path analysis and controlled exploitation to validate real-world risk. \nDevelop proof-of-concept exploits, custom scripts and automation to reproduce vulnerabilities and demonstrate business impact. \nEvaluate containerized and Kubernetes environments, including EKS, for workload isolation, RBAC issues, exposed services, image risks, secrets handling and runtime security gaps. \nAssess CI/CD pipelines for insecure workflows, overprivileged tokens, secrets exposure, supply chain risks, artifact integrity and deployment abuse paths. \nPerform software composition analysis to identify vulnerable dependencies, license risks, malicious packages, transitive dependency exposure and supply chain weaknesses. \nUse SIEM and security telemetry to support investigations, validate attack paths, improve detections and measure control effectiveness. \nBuild detection logic, threat hunting queries, dashboards and alerting workflows using SIEM platforms such as Splunk, Microsoft Sentinel, Elastic, Chronicle or AWS-native telemetry. \nUse AWS security services such as GuardDuty, Security Hub, CloudTrail, AWS Config, Inspector, Detective, Macie, IAM Access Analyzer, Security Lake and CloudWatch to improve visibility and detection coverage. \nAutomate security workflows using Python, Bash, PowerShell, Go or similar scripting languages. \nDevelop threat automation for vulnerability enrichment, alert triage, AWS posture checks, attack simulation, evidence collection and remediation tracking. \nPartner with DevOps and platform teams to improve secrets management, identity controls, network segmentation, logging, monitoring and secure deployment patterns. \nAssess AI and LLM-based systems for risks such as prompt injection, indirect prompt injection, data leakage, insecure tool use, excessive agency, jailbreaks, model abuse, retrieval poisoning and unsafe agent behavior. \nReview AI workloads using AWS services such as Amazon Bedrock, SageMaker, Lambda, API Gateway, S3, KMS and IAM for secure design, data protection and access control. \nProduce clear technical reports with evidence, exploitability, impact, likelihood, risk rating and actionable remediation guidance. \nMentor engineers and security team members on secure coding, AWS security, offensive testing, threat modeling and AI security risks. \nRequired Qualifications\nStrong hands-on experience in application security, product security, AWS cloud security, offensive security or security engineering. \nDeep understanding of secure SDLC practices and experience embedding security into engineering workflows. \nPractical experience with SAST, DAST, SCA, manual penetration testing, code review and vulnerability validation. \nStrong knowledge of OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, common CWE classes and real-world application attack techniques. \nExperience testing web applications, APIs, microservices, cloud services, containers and distributed systems. \nStrong understanding of authentication, authorization, identity federation, OAuth, OIDC, SAML, JWT, session security and access control design. \nHands-on experience securing AWS environments in production. \nStrong knowledge of AWS IAM, VPC networking, encryption, KMS, Secrets Manager, S3 security, CloudTrail, GuardDuty, Security Hub, AWS Config and workload hardening. \nExperience reviewing infrastructure-as-code and identifying security issues in Terraform, CloudFormation, AWS CDK, Kubernetes YAML, Helm, Dockerfiles or similar technologies. \nExperience with CI/CD security across tools such as bitbucket pipelines, Jenkins, AWS CodePipeline, or similar platforms. \nExperience with red teaming, adversary emulation, penetration testing, exploit development, attack path mapping or offensive security assessments. \nFamiliarity with SIEM platforms and the ability to write detection or hunting queries using SPL, KQL, SQL, Lucene, YARA, Sigma or similar languages. \nStrong scripting ability in Python, Bash, PowerShell, JavaScript or similar languages. \nAbility to automate repetitive security tasks and build internal tools that improve security testing, visibility and response. \nFamiliarity with container and Kubernetes security, including ECS,EKS, RBAC, admission controls, image scanning, runtime controls, network policies and secrets handling. \nAbility to review code in languages such as Python, JavaScript, TypeScript, Java, Go, Kotlin, C# or similar. \nStrong written and verbal communication skills, with the ability to explain complex technical risks to engineering and leadership teams. \nPreferred Qualifications\nExperience securing AI-enabled applications, LLM products, autonomous agents, RAG pipelines, AI plugins or ML infrastructure. \nExperience performing AI red teaming, prompt injection testing, jailbreak testing, model abuse testing or evaluation of agentic workflows. \nExperience with AWS Organizations, Control Tower, service control policies, multi-account security patterns and centralized logging. \nExperience with threat modeling methodologies such as STRIDE, PASTA, attack trees, abuse cases, data flow diagrams or architecture risk reviews. \nExperience with security automation, SOAR workflows, detection-as-code, policy-as-code or cloud security posture automation. \nExperience with tools such as Burp Suite Pro, OWASP ZAP, Semgrep, CodeQL, Checkmarx, Fortify, Veracode, Snyk, Dependabot, Trivy, Grype, Syft, Gitleaks, Checkov, tfsec, Prowler, ScoutSuite, Wiz, Prisma Cloud or similar. \nExperience building custom security tooling, scanners, exploit harnesses, detection rules, cloud guardrails or CI/CD security integrations. \nExperience with MITRE ATT&CK, MITRE ATLAS, CIS Benchmarks, AWS Well-Architected Security Pillar, NIST, ISO 27001, SOC 2, PCI DSS or similar frameworks. \nExperience with bug bounty programs, coordinated vulnerability disclosure, internal red team programs or external penetration testing engagements. \nRelevant certifications such as OSCP, OSWE, OSEP, GWAPT, AWS Certified Security Specialty, AWS Solutions Architect, CISSP or equivalent practical experience. \nWhat Success Looks Like\nSecurity is embedded into design, development, testing and deployment workflows. \nSAST, DAST, SCA, secrets scanning, IaC scanning and AWS posture checks are implemented with practical tuning and low operational noise. \nHigh-risk application and AWS vulnerabilities are identified early, validated accurately and remediated with engineering partnership. \nThreat models are used to influence architecture decisions before systems reach production. \nRed team findings translate into improved controls, stronger detections and reduced attack paths. \nSIEM, AWS logs and security telemetry are used to validate security controls and detect realistic abuse scenarios. \nSecurity automation reduces manual review effort and accelerates vulnerability management, investigation and remediation. \nAI-enabled systems are reviewed for emerging threats before they are released or scaled. \nEngineering teams view security as a technical partner that helps them ship resilient products.","description_format":"text","description_chars":10632,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Artificial Intelligence","Financial Services","Nonprofit, Church & Membership Software"],"lifecycle":[{"event":"open","at":"2026-10-22T09:43:28Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":27,"reasons":["conf:1","win:early","comp:remote"],"computed_at":"2026-10-22T18:32:14Z"},"pay":null,"html_url":"https://alion.io/job/cinc-systems-security-engineer","json_url":"https://alion.io/job/cinc-systems-security-engineer.json","meta":{"generated_at":"2026-10-22T18:32:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1210,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2460684},"rest":"https://alion.io/mcp/rest/get_company?id=2460684"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcinc-systems-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcinc-systems-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcinc-systems-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cinc-systems-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcinc-systems-security-engineer"}]}