Security Engineer (Product Security)

Lowcountry Cyber is hiring a Security Engineer (Product Security) to work remotely from the US. We're looking for help maturing our controls ahead of an SOC 2 Type II and ISO 27001 audit cycle. Fully remote. You can work from anywhere in the US. Monday to Friday, regular working hours, flexible start and finish. Clear written English is a must, as the team works across time zones.

Essential duties and responsibilities:

• Maintain EDR coverage with CrowdStrike Falcon or Microsoft Defender for Endpoint.
• Build detections and response playbooks in Splunk, Microsoft Sentinel or Elastic.
• Design and maintain SSO, MFA and conditional access with Okta or Entra ID.
• Assess third-party vendors and SaaS integrations for security risk.
• Triage bug bounty reports from HackerOne or Bugcrowd.
• Write secure coding guidelines and run developer training.
• Run threat modeling sessions with engineering teams on new features and architecture changes.
• Coordinate external penetration tests and track remediation.

Required qualifications:

• 3+ years in security engineering, application security or a related engineering role.
• Strong knowledge of the OWASP Top 10 and common web vulnerabilities.
• Understanding of networking, TLS, PKI and authentication protocols (SAML, OIDC, OAuth 2.0)
• Hands-on cloud security experience in AWS, Azure or GCP.
• Programming or scripting ability in Python, Go or similar.
• Ability to explain security issues to engineers without lecturing them.

Bonus points:

• Running a bug bounty program.
• Contributions to security tools or published CVEs.
• Kubernetes and container security (Falco, OPA Gatekeeper)

What you get:

Pay range: $145,000 - $190,000 annually. Final offer will depend on experience.

• Medical, dental and vision insurance.
• 401(k) with 4% match.
• Paid sick leave.
• Paid holidays.
• Annual bonus.
• Short- and long-term disability.

A bit about us:

Most engagements start with a vulnerability scan and a tabletop exercise with the client's leadership. Our managed detection and response service is built on CrowdStrike, SentinelOne and Microsoft Defender. We started in 2017 and have grown to about 200 people. Lab time is built into the schedule, not squeezed in after hours.

Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Lowcountry Cyber LLC.