Principal Security Engineer

About SF IT

Started by a former school district network admin in 2020, the business has grown almost entirely through referrals. Our dress code is a company polo and clean jeans.

The role

The role is new and comes from growth in our client base. SF IT is hiring for the Principal Security Engineer role to secure our cloud infrastructure and the applications that run on it. We're looking for help maturing our controls ahead of an SOC 2 Type II and ISO 27001 audit cycle. The company is based in Ann Arbor, the US. Our team works from several countries. You will be employed through our employer-of-record partner in Uruguay, with a local contract and salary paid in local currency. You will need at least 4 hours of overlap with US Eastern time.

In your first few months you will

• Triage bug bounty reports from HackerOne or Bugcrowd
• Own secrets management, key rotation and KMS policies
• Automate security checks in CI/CD pipelines
• Harden AWS, Azure or GCP accounts and fix misconfigurations found by Wiz, Prisma Cloud or Security Hub
• Manage SAST, DAST and dependency scanning with tools such as Semgrep, Snyk, Burp Suite or GitHub Advanced Security

About you

• 8-10 years in security engineering, application security or a related engineering role
• Strong knowledge of the OWASP Top 10 and common web vulnerabilities
• Understanding of networking, TLS, PKI and authentication protocols (SAML, OIDC, OAuth 2.0)

Preferred qualifications

• Kubernetes and container security (Falco, OPA Gatekeeper)
• Malware analysis or digital forensics background
• IaC scanning with Checkov or tfsec

Pay and benefits

• Co-working space stipend
• Health insurance through our employer-of-record partner
• Paid sick days
• Monthly internet allowance
• Performance bonus

Start: Flexible.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at SF IT.