Senior Security Engineer

Small accounting firms in New York use our engagement letter and e-signature tool, and most heard about us from a colleague. Most engineers work remotely and come into the office one week a quarter for planning.

About the role

We are adding a Senior Security Engineer to our operations team. We're looking for help maturing our controls ahead of an SOC 2 Type II and ISO 27001 audit cycle. Remote position. Most of the team is in New York City, but nobody is required to come in. Monday to Friday, regular working hours, flexible start and finish.

What you'll be doing

• Maintain EDR coverage with CrowdStrike Falcon or Microsoft Defender for Endpoint
• Review code and pull requests for security issues
• Run threat modeling sessions with engineering teams on new features and architecture changes
• Respond to security incidents and lead the technical investigation
• Coordinate external penetration tests and track remediation
• Triage bug bounty reports from HackerOne or Bugcrowd

You'll need

• 5-7 years in security engineering, application security or a related engineering role
• Programming or scripting ability in Python, Go or similar
• Understanding of networking, TLS, PKI and authentication protocols (SAML, OIDC, OAuth 2.0)
• Hands-on cloud security experience in AWS, Azure or GCP
• Experience with SIEM, EDR or vulnerability management tools

Nice to have

• Kubernetes and container security (Falco, OPA Gatekeeper)
• IaC scanning with Checkov or tfsec

Compensation and benefits

Pay: $186,000 - $220,000 per year

• Flexible schedule
• Home office stipend

Interview process: a phone call, a meeting with the hiring manager, and a final conversation with the team.

Duration: 3 months. Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Heronbridge Labs.