Senior Security Engineer

RevolutionParts is not just a pioneering force in the automotive eCommerce realm; we're actively seeking passionate and talented individuals to join our squad of Revolutionaries (yes, that's what we call ourselves!). As leaders in providing streamlined, user-friendly solutions, we empower automotive brands to maximize online sales. Our commitment to technology, top-notch customer service, and a profound understanding of the automotive market sets us apart. If you're ready to revolutionize the eCommerce space for automotive parts and accessories, consider joining our dynamic team of Revolutionaries.

AI Fluency & Modern Tooling

At RevolutionParts, we expect team members to actively use modern tools - including AI-powered systems - to improve decision-making, productivity, and quality of work.

This includes:

• Using AI tools responsibly to accelerate research, analysis, documentation, and problem-solving
• Exercising strong judgment around data privacy, accuracy, and ethical use
• Continuously learning and adapting as AI capabilities evolve

Proven examples of using AI to improve outcomes in prior roles is expected.

The Role

RevolutionParts is an automotive eCommerce platform. AI is raising both the speed and the complexity of attacks and of vulnerability discovery, and we intend to meet that pace with AI of our own. Our CloudOps team is becoming a CloudSecOps team, and we are hiring a security engineer who puts AI at the center of the work to continuously find where we are exposed, set up the systems and practices that keep us secure, and help the people around you get better at security.

What this role is: analysis, prevention, and the delegation of work. You will find and prove our weaknesses across cloud, applications, and third-party tools, rank them by real risk, and get them to the right owner. This role does not take on day-to-day CloudOps requests or the infrastructure on-call rotation; the CloudOps team keeps that work.

How AI fits: we expect you to lean hard on AI. Use AI-assisted scanning, code review, and triage to find issues faster than a person could, automate the repeat work, and set up guardrails and detection so the program runs on a steady rhythm. You will also define how our engineers use AI safely.

You guide teams through the fixes that belong to them; you do not take on the work in their stack. You will write code of your own, though: scripts, automation, detections, and security tooling, much of it built with AI. Much of the job is coordination: chasing down answers, getting the right people in a room, and following up with stakeholders and owners until the work is done. This is not a role that writes a report and moves on. You find the problem, get it to the right owner, and stay on it until it is fixed.

What you will do

Find and prove

• Run AI-assisted scanning of our code, infrastructure, and cloud configuration, and triage the results into real, ranked findings
• Test our applications the way an attacker would, through pentesting and ethical hacking, with a focus on business logic flaws in checkout, account, and payment flows
• Run quarterly access reviews, and ensure that SSO and MFA stays consistent across the SaaS tools we manage
• Review our AWS, Kubernetes, and infrastructure-as-code setup for weaknesses in identity, encryption, secrets, and network controls, and hand clear, prioritized fixes to the owning teams
• Own our pentest and bug bounty work: scope it, triage what comes in, give each finding an owner and a severity-based deadline, and verify every fix
• Set our edge security policy as we modernize: WAF and bot management (letting search engines and approved AI crawlers through while blocking malicious bots), TLS, DNS, and certificates

Operate and respond

• Watch AWS security signals and our SIEM and EDR; keep endpoint coverage complete across servers, clusters, and devices; and lead the security side of incidents alongside our incident commander
• Get full value from the security tools we already have, starting with our SIEM: bring in the right data sources, build and tune detections, cut noise, and show leadership what each tool delivers
• Own code security day-to-day in GitHub and our code analysis tools: dependency alerts, code and secret scanning, quality gates on pull requests, branch protection, and repository access, with findings routed to the right teams
• Help design and run tabletop exercises with the infrastructure team, owning the security scenarios
• Coordinate our response when a widely exploited vulnerability hits (think Log4Shell), drive patching to completion, and document risk acceptance when we choose not to patch
• Keep our compliance work (SOC 2, ISO 27001, PCI DSS, security questionnaires, partner assessments, quarterly PCI ASV scans, and the Trust Center) on schedule, and use AI and a compliance platform to automate evidence collection and questionnaire drafting so it stays a small share of your time
• Keep our contractual security obligations visible and our security processes documented
• Define how engineers use AI safely: what data can and cannot go to AI tools, prompt-injection risks, and how to review AI-generated security suggestions
• Set best practices for handling PII and route them to the teams that own each system

Prevent

• Build guardrails so issues do not come back: policy-as-code, organization-level controls, and security checks in CI/CD and GitHub
• Mature detection and incident readiness, including runbooks and response playbooks
• Defend against AI-accelerated attacks: shorten the time from a disclosed vulnerability to a verified fix, harden identity and email against AI-written phishing and impersonation, detect automated credential and bot abuse, and help shape the roadmap for where we invest next
• Evaluate security tools from the major vendors and automate recurring scans, ticket creation, and reporting

What success looks like

Strong cloud security teams measure outcomes, not activity. Here is how we will know this role is working.

Early on

• You know our environment end to end and have a risk-ranked plan the team agrees on
• AI-assisted scanning runs on a regular schedule and produces triaged findings, not raw noise
• Every open security finding has an owner, a severity, and a due date

Over time

• Vulnerabilities are fixed within severity-based timelines, internet-facing critical issues first, and exceptions are documented as risk acceptances; the time from a public exploit to our fix keeps shrinking as attackers get faster
• Security controls live in code, and guardrails catch misconfigurations before they reach production, so fewer new findings appear each quarter
• Our security tools earn their cost: the right data flows into the SIEM, detections are tuned, and time to detect and respond keeps improving
• Audits, scans, partner assessments, and questionnaires are completed on time with evidence ready, not in a scramble
• Incident runbooks are tested in tabletop exercises and improved after every incident
• Leadership gets a regular, plain-language view of security risk and trends, and application teams bring security questions to you early
• The CloudSecOps team and engineering teams handle more security work on their own, because you have helped them learn how

What you bring

• 5+ years in cloud, infrastructure, application, or security engineering, with recent years focused on security
• Strong working knowledge of cloud infrastructure, especially AWS: IAM, encryption, logging, network controls, and native security services, enough to find flaws and guide the fix
• Able to read infrastructure as code (Terraform) and spot security misconfigurations, and comfortable scripting in Python, Bash, or similar to automate scans, detections, and reporting
• A track record of driving security remediation: pentest and scan findings, patching, and widely exploited vulnerabilities, driven to verified closure across teams
• Experience in SOC 2, ISO 27001, or PCI DSS environments at an eCommerce company or a high-traffic SaaS platform: access reviews, audit evidence, questionnaires, and third-party assessments, including working with auditors
• Experience with vulnerability management and incident response
• Application security testing experience (pentesting or ethical hacking), especially business logic flaws in web apps; strongly preferred
• Hands-on use of AI in security work, such as AI-assisted scanning, triage, or code review, with a clear view of how to use AI safely
• Security certifications such as CISSP, CISM, Security+, or equivalent strongly preferred
• Excellent written communication skills; comfortable writing clear, accurate responses for customer-facing security documentation
• Hands-on experience running a SIEM and EDR: building and tuning detections, investigating alerts, and leading incident response
• Strong follow-through, clear writing, and a habit of teaching: you work independently, help others grow, use AI tools daily, and learn and unlearn quickly, letting go of tools and habits that AI or new threats have made obsolete

Nice to have

• EDR, WAF, and bot management platforms
• Kubernetes (EKS) and container security
• Building preventive guardrails: policy-as-code, AWS organization controls, and security checks in CI
• Secrets management with HashiCorp Vault or similar, and Zero Trust remote access
• A compliance automation platform such as Vanta, Drata, or Delve, plus GitHub security features and static analysis tools
• Writing Terraform
• Working with AI to build in house security tooling to assist in the awareness and remediation of security vulnerabilities
• Security certifications (AWS Security Specialty, Security+, CISSP, or similar)

If you meet most of what is listed here and the work excites you, we would like to hear from you.

Why RevolutionParts

• Autonomy: you decide how we find our weaknesses and how we prevent them
• Build the function: help turn CloudOps into CloudSecOps and shape how security works here
• AI tooling: we are AI-first, and you will have room to build how we use AI to find and prevent security problems
• Real impact: your work protects a high-traffic eCommerce platform that automotive businesses and their customers rely on every day
• Mentor and grow others: raise the security skills of the engineers you work with
• A real bias for action: we make decisions quickly and ship; good ideas do not wait months for approval

*Please note that this is a hybrid role that requires that you work from our Tempe, Arizona, offices at least 2 days per week.

RevolutionParts is proud to provide all full-time Revolutionaries with a comprehensive employment package including competitive compensation, career development, benefits, 401K match, parental leave, and many more valuable perks. You can learn more about our core-value driven culture at our career page.

RevolutionParts is an Equal Opportunity Employer; we value diversity. We do not discriminate on the basis of race, religion, color, national origin, gender, gender orientation, gender identity or expression, sexual identity, sexual orientation, age, marital status, family status, genetic information, veteran status, or disability status.

Please Note: You will only receive correspondence through the Gem ATS or from a @revolutionparts.com email address. If you are receiving communication through any other platform or domain, it may be fraudulent, and we urge you to ignore the communication.