Senior Security Engineer

The Opportunity

We are looking for an independent, passionate, and persuasive Senior Security Engineer to join our Security Engineering team. You will play a crucial role in driving vulnerability remediation and securing applications from the outset, utilizing cutting-edge solutions to effectively prevent attacks and safeguard the business.

What you'll do

• Work closely with the engineering team on all security initiatives, ensuring products are built securely by default and that audits and remediation efforts are managed to achieve smooth, timely resolution.
• Conduct risk assessments and vulnerability analyses to identify threats and security gaps in existing and new systems and architectures.
• Perform vulnerability scanning across networks, systems, middleware, and databases, then assess each finding by likelihood and potential impact to prioritize what matters.
• Manage the remediation lifecycle with a risk-based approach, ensuring vulnerabilities are resolved in line with accepted industry standards.
• Implement and manage static and dynamic code analysis (SAST/DAST) in CI/CD pipelines; perform source code security reviews and advise developers on remediation.
• Manage the end-to-end process for externally reported vulnerabilities and bug bounty submissions.
• Lead initiatives that measurably reduce risk across our application and infrastructure stack, including applying AI/ML tooling where it delivers real leverage.
• Use scripting and automation to remove manual toil and improve team workflows, rather than defaulting to manual processes out of habit

What we expect

• Take strong ownership of outcomes beyond assigned tasks: proactively identify risks, surface them early to the right stakeholders, and drive resolution without waiting to be asked.
• Clarify vulnerabilities and risks directly with product and engineering stakeholders rather than assuming; communicate bad news, delays, scope changes, and newly discovered risks early, and always pair them with options, not just problems.
• Stay flexible and resourceful, taking on new challenges as the business evolves

What you'll bring

• At least 5+ years in cybersecurity, of which 3+ years is focused on vulnerability management
• At least 3+ years in software development and scripting (Java, Node.js, Python) with continued hands-on use. Able to independently write scripts and simple web apps to solve day-to-day security needs
• Solid foundations in networking, operating systems, and applications
• Demonstrated track record of self-directed work rather than just completed assignments, with concrete examples of risks you identified, owned, and drove to resolution independently, including picking up new skills as needed
• Strong stakeholder management: able to clarify vulnerabilities and risks directly with product and engineering, and communicate effectively with both technical and non-technical audiences

Bonus if you have

• Experience building dedicated internal tools, dashboards, or CI/CD integrations beyond ad hoc scripting
• Experience in bug bounty, penetration testing, and vulnerability assessment
• Knowledge of cloud security
• Knowledge of container security
• Knowledge of AI security
• Knowledge of DevSecOps and security tools in CI/CD
• Hold OSCP, OSWE, AWS Certified Security - Specialty, Google Professional Cloud Security Engineer, Microsoft Certified: Azure Security Engineer Associate, GPEN, and/or CREST certification
• Experience with a tech or financial services company