Principal Security Engineer

About us:

Our main product is a payroll and timekeeping app for hourly workforces, sold by subscription and supported from Houston. The product is a mobile app plus a React web dashboard, with a Python and PostgreSQL backend on AWS.

The role:

Looking for a Principal Security Engineer who wants to stay somewhere for a while. This hire will run our application security program: threat modeling, code scanning, pen test follow-up and developer guidance. Hybrid. You will need to be in Houston at least two days per week.

What you'll do:

• Write secure coding guidelines and run developer training
• Build detections and response playbooks in Splunk, Microsoft Sentinel or Elastic
• Triage bug bounty reports from HackerOne or Bugcrowd
• Assess third-party vendors and SaaS integrations for security risk
• Run threat modeling sessions with engineering teams on new features and architecture changes

You have:

• 7+ years in security engineering, application security or a related engineering role
• Understanding of networking, TLS, PKI and authentication protocols (SAML, OIDC, OAuth 2.0)
• Strong knowledge of the OWASP Top 10 and common web vulnerabilities
• Good judgment on risk: knowing what to fix now and what can wait

Benefits:

Starting pay: $215,000 - $260,000/year, depending on experience and certifications.

• Health, dental and vision coverage starting on day one
• 401(k) with 4% match
• Three weeks of PTO to start
• Flexible schedule
• Cell phone reimbursement

We read every application and reply within about a week.

Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Keyway Labs.