Security Engineer

COMPANY OVERVIEW

Based in Fort Collins, Herontower Security also trains client staff and runs simulated phishing campaigns. Incident response is a big part of the work: ransomware recovery, business email compromise and forensic investigations. We write internal post-mortems after every major engagement, including what went wrong.

OVERVIEW

We're looking for a Security Engineer to join our team. This is a remote role. The operations team is small and hands-on. We need someone who writes code and automation, not just policy. We're looking for help maturing our controls ahead of an SOC 2 Type II and ISO 27001 audit cycle. Employment is through our payroll partner in India. Salary is paid monthly in Indian rupees. You will need at least 4 hours of overlap with US Central time.

DUTIES

• Review code and pull requests for security issues
• Assess third-party vendors and SaaS integrations for security risk
• Design and maintain SSO, MFA and conditional access with Okta or Entra ID
• Run threat modelling sessions with engineering teams on new features and architecture changes
• Own secrets management, key rotation and KMS policies

REQUIREMENTS

• 2-4 years in security engineering, application security or a related engineering role
• Hands-on cloud security experience in AWS, Azure or GCP
• Ability to explain security issues to engineers without lecturing them
• Good judgment on risk: knowing what to fix now and what can wait

DESIRABLE

• IaC scanning with Checkov or tfsec
• Running a bug bounty program

BENEFITS

• 24 days paid time off
• Monthly internet allowance
• Annual learning budget
• Annual salary review
• Co-working space stipend
• Performance bonus
• Paid sick days

We may close this posting early once we have enough applications.

Please submit your CV in English.

Start: Flexible.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Herontower Security, LLC.