Senior Security Engineer, Remote

Public sector agencies, utilities and large health systems license our asset management platform under multi-year contracts. On-call rotates weekly and pays a flat stipend whether or not the pager goes off.

Role overview

This is a backfill for a team member who moved to another team. We're looking for help maturing our controls ahead of an SOC 2 Type II and ISO 27001 audit cycle. Our team is spread across 14 countries. Headquarters is in London. Employment is through our payroll partner in the US. Salary is paid monthly in USD. Working hours overlap with UK business hours.

Responsibilities

• Write secure coding guidelines and run developer training
• Automate security checks in CI/CD pipelines
• Triage bug bounty reports from HackerOne or Bugcrowd
• Harden AWS, Azure or GCP accounts and fix misconfigurations found by Wiz, Prisma Cloud or Security Hub
• Build detections and response playbooks in Splunk, Microsoft Sentinel or Elastic
• Respond to security incidents and lead the technical investigation

Qualifications

• 5+ years in security engineering, application security or a related engineering role
• Strong knowledge of the OWASP Top 10 and common web vulnerabilities
• Hands-on cloud security experience in AWS, Azure or GCP
• Ability to explain security issues to engineers without lecturing them
• Good judgment on risk: knowing what to fix now and what can wait

Preferred qualifications

• OSCP, OSWE, CISSP or a cloud security certification (AWS Security Specialty, AZ-500)
• Kubernetes and container security (Falco, OPA Gatekeeper)
• IaC scanning with Checkov or tfsec
• Running a bug bounty program

Pay range: $165,000 - $205,000 annually. Final offer will depend on experience.

Pay and benefits

• Annual team retreat
• Co-working space stipend
• Wellness allowance
• Home office setup budget
• Company laptop
• 20 days paid time off

SMR Cloud provides equal employment opportunities to all employees and applicants.

Start: Flexible.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at SMR Cloud.