Senior Information Security Engineer

Tidewater Cyber runs a 24/7 security operations center that monitors endpoints, firewalls and cloud accounts for mid-sized companies. Most engagements start with a vulnerability scan and a tabletop exercise with the client's leadership. Founded in 2019, we now have 120 employees. SOC analysts work 12-hour shifts on a 2-2-3 rotation.

The role:

We're looking for help maturing our controls ahead of an SOC 2 Type II and ISO 27001 audit cycle. Tidewater Cyber is hiring for the Senior Information Security Engineer role to secure our cloud infrastructure and the applications that run on it. This role is fully remote within the US. Flexible schedule. We have one team call a day, usually in the morning.

Responsibilities:

• Triage bug bounty reports from HackerOne or Bugcrowd
• Own secrets management, key rotation and KMS policies
• Review code and pull requests for security issues
• Manage SAST, DAST and dependency scanning with tools such as Semgrep, Snyk, Burp Suite or GitHub Advanced Security
• Write secure coding guidelines and run developer training
• Assess third-party vendors and SaaS integrations for security risk

What you'll need:

• 6+ years in security engineering, application security or a related engineering role
• Strong knowledge of the OWASP Top 10 and common web vulnerabilities
• Good judgment on risk: knowing what to fix now and what can wait
• Hands-on cloud security experience in AWS, Azure or GCP

Preferred qualifications:

• Malware analysis or digital forensics background

Pay and benefits:

Pay range: $230,000 - $305,000 per year. Final offer will depend on experience.

• Health, dental and vision coverage starting on day one
• 401(k) with company match
• Paid holidays
• Employee assistance program
• Professional development budget
• Home office stipend

Start: Flexible.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Tidewater Cyber, LLC.