Security Engineer, Detection and Response

About Ashcombe Risk Partners

We do penetration testing, red team engagements and web application assessments for banks, hospitals and SaaS companies. Incident response is a big part of the work: ransomware recovery, business email compromise and forensic investigations. Nobody gets in trouble for clicking a test phish. You report it and move on.

Job summary

We are adding a Security Engineer, Detection and Response to our Security team. This hire will run our application security program: threat modeling, code scanning, pen test follow-up and developer guidance. Fully remote, but we prefer candidates within a few hours of Mountain time.

Main duties

• Maintain EDR coverage with CrowdStrike Falcon or Microsoft Defender for Endpoint
• Coordinate external penetration tests and track remediation
• Triage bug bounty reports from HackerOne or Bugcrowd
• Automate security checks in CI/CD pipelines
• Assess third-party vendors and SaaS integrations for security risk
• Run threat modeling sessions with engineering teams on new features and architecture changes

What you'll need

• 3-5 years in security engineering, application security or a related engineering role
• Hands-on cloud security experience in AWS, Azure or GCP
• Understanding of networking, TLS, PKI and authentication protocols (SAML, OIDC, OAuth 2.0)

Why work with us

• Health insurance
• 401(k) with 4% match
• 11 paid holidays
• Employee assistance program
• Dental insurance
• Professional development budget

EOE. We participate in E-Verify.

Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Ashcombe Risk Partners LLC.