Security Engineer

About Herontower Security:

Based in Fort Collins, Herontower Security also trains client staff and runs simulated phishing campaigns. Incident response is a big part of the work: ransomware recovery, business email compromise and forensic investigations. We write internal post-mortems after every major engagement, including what went wrong.

About the role:

We're looking for a Security Engineer to join our team. This is a remote role. This hire will run our application security program: threat modelling, code scanning, pen test follow-up and developer guidance. Our headquarters is in Fort Collins, and about a third of the team works remotely from other countries. This is a long-term contractor role, paid monthly in USD. Core hours overlap with US Central time, 9:00 AM to 1:00 PM CT. We send you a laptop and the accessories you need on day one.

Day to day:

• Triage bug bounty reports from HackerOne or Bugcrowd
• Build detections and response playbooks in Splunk, Microsoft Sentinel or Elastic
• Assess third-party vendors and SaaS integrations for security risk
• Respond to security incidents and lead the technical investigation
• Coordinate external penetration tests and track remediation
• Review code and pull requests for security issues

About you:

• 3+ years in security engineering, application security or a related engineering role
• Hands-on cloud security experience in AWS, Azure or GCP
• Strong knowledge of the OWASP Top 10 and common web vulnerabilities
• Good judgment on risk: knowing what to fix now and what can wait
• Ability to explain security issues to engineers without lecturing them

Preferred:

• OSCP, OSWE, CISSP or a cloud security certification (AWS Security Specialty, AZ-500)

Pay and benefits:

• Annual rate review
• Company laptop
• Paid in USD

Duration: 6 months. Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Herontower Security, LLC.