Member of Technical Staff, Security

Profound•New York, NY

1d•$200,000 - $250,000

About The Position

Profound is hiring a Security Engineer to join its Security Engineering team. The role owns technical security controls across the platform, cloud infrastructure, and corporate environment, working with Engineering, Infrastructure, IT, and GRC to keep controls effective as the company scales. The position is intended for someone who sees security as a business accelerator and prefers building and improving systems over auditing them. During the first 90 days, the new hire will learn the environment, take ownership of a focus area, work with Infrastructure to close high-risk AWS gaps, and tune CI/CD and cloud scanning so findings are accurate, prioritized, and remediated on schedule. The role will also mature vulnerability management, improve detection and monitoring, support continuous SOC 2 compliance and enterprise customer security reviews, and contribute to incident reviews and risk prioritization. The posting gives several focus-area options in brackets rather than specifying one.

Requirements

At least 5 years of security engineering experience, including experience in high-growth SaaS or infrastructure-heavy environments.
Experience supporting or maintaining a SOC 2 program.
Strong knowledge of AWS security services and cloud security architecture, including IAM, VPC, CloudTrail, GuardDuty, and Security Hub.
Solid understanding of identity and authentication protocols, including OAuth, SAML, and OIDC.
Scripting skills in Python or Bash to automate security workflows.
Ability to clearly explain security risk in business terms to engineers, leadership, and customer-facing teams.
Systems-thinking skills, including reasoning about root causes, blast radius, and scalable control design.
Self-directed judgment and effectiveness as part of a team that shares ownership of the security program.

Nice To Haves

Experience running vulnerability management and security scanning, including SAST, DAST, SCA, and container scanning, in CI/CD workflows.
Infrastructure-as-code security experience with Terraform or CloudFormation.
Familiarity with network security fundamentals, including firewalls, DNS, VPNs, segmentation, and traffic analysis.
Background in penetration testing, application security assessments, or CTF competitions.
Familiarity with data infrastructure security for systems such as ClickHouse or PostgreSQL.
Experience with data processing compliance in analytics-heavy environments.
Relevant certifications such as CISSP, CCSP, AWS Security Specialty, or similar.

Responsibilities

Learn the company’s environment and take ownership of a security focus area during the first 90 days.
Work with Infrastructure to address the highest-risk gaps in the AWS environment.
Tune CI/CD and cloud scanning to improve the accuracy and prioritization of findings and ensure timely remediation.
Run and mature vulnerability management across infrastructure, applications, and dependencies, including triage, severity-based remediation targets, and exception handling.
Triage and respond to findings from automated tools, bug bounty reports, and third-party assessments.
Enforce least-privilege access and conduct regular access reviews across environments.
Work with Infrastructure to improve detection and monitoring using log aggregation and SIEM tools.
Provide engineering evidence, including scans, access reviews, and hardening evidence, to support continuous SOC 2 compliance in collaboration with GRC.
Support customer security reviews by answering technical questions from enterprise buyers.
Lead post-incident reviews and drive systemic fixes.
Contribute to risk assessments and the risk register, and help set priorities.