Security Engineer

Public sector agencies, utilities and large health systems licence our asset management platform under multi-year contracts.

The position:

We are creating this position because the workload has grown. This hire will run our application security program: threat modelling, code scanning, pen test follow-up and developer guidance. The Application Security team is small and hands-on. We need someone who writes code and automation, not just policy. Our team is spread across 11 countries. Headquarters is in Buffalo. Employment is through our payroll partner in Pakistan. Salary is paid monthly in Pakistani rupees. You will need at least 4 hours of overlap with US Eastern time.

Duties:

• Maintain EDR coverage with CrowdStrike Falcon or Microsoft Defender for Endpoint.
• Manage SAST, DAST and dependency scanning with tools such as Semgrep, Snyk, Burp Suite or GitHub Advanced Security.
• Assess third-party vendors and SaaS integrations for security risk.
• Respond to security incidents and lead the technical investigation.
• Automate security checks in CI/CD pipelines.
• Run threat modelling sessions with engineering teams on new features and architecture changes.
• Review code and pull requests for security issues.

Qualifications:

• 2-4 years in security engineering, application security or a related engineering role.
• Understanding of networking, TLS, PKI and authentication protocols (SAML, OIDC, OAuth 2.0)
• Ability to explain security issues to engineers without lecturing them.
• Programming or scripting ability in Python, Go or similar.

Perks and benefits:

• Monthly internet allowance.
• Wellness allowance.
• Annual learning budget.
• Two weeks of paid leave at year end.
• Flexible hours.
• Performance bonus.
• Public holidays observed per your country.

Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at TWA Technologies.