Junior Cyber Security Engineer

We are 30 people, all hands-on, and the founders still run engagements themselves.

This is a newly created position. The operations team is small and hands-on. We need someone who writes code and automation, not just policy. This hire will run our application security program: threat modelling, code scanning, pen test follow-up and developer guidance. This is a long-term contractor role, paid monthly in USD. Core hours overlap with US Central time, 9:00 AM to 1:00 PM CT. Most communication happens in Slack, with short video calls when needed.

What you'll be doing

Coordinate external penetration tests and track remediation. Manage SAST, DAST and dependency scanning with tools such as Semgrep, Snyk, Burp Suite or GitHub Advanced Security. Triage bug bounty reports from HackerOne or Bugcrowd. Own secrets management, key rotation and KMS policies. Respond to security incidents and lead the technical investigation. Design and maintain SSO, MFA and conditional access with Okta or Entra ID.

Required qualifications

0-2 years in security engineering, application security or a related engineering role. Strong knowledge of the OWASP Top 10 and common web vulnerabilities. Ability to explain security issues to engineers without lecturing them. Programming or scripting ability in Python, Go or similar. Understanding of networking, TLS, PKI and authentication protocols (SAML, OIDC, OAuth 2.0).

Pay and benefits

Long-term engagement. Company laptop.

Duration: 3 months. Start: Flexible.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Atlantic Cyber Ltd..