Security Engineer

HUMAN•New York, NY

1d•Remote

About The Position

We are seeking a hands-on Principal Security Engineer to join our small, high-impact security team that protects our products, corporate environments, and customers. This is a senior individual contributor role that sits at the intersection of corporate security, incident response, compliance and product security. In this role, you will partner closely with multiple teams to embed security into how we build, operate, and defend HUMAN.

Requirements

7+ years of experience in information security or software engineering roles such as security engineer, platform engineer, or GRC engineer, with clear responsibility for building and automating security controls.
Strong familiarity with modern cloud environments (AWS, GCP, or Azure) and their security controls.
Strong coding or scripting skills in at least one language (for example, Python, Go, etc.) working with APIs, automation, and infrastructure as code.
Practical experience with at least some of: Identity and access management (SSO, SAML/OIDC, RBAC, least privilege, automation workflows), Endpoint security and configuration management, Logging/SIEM and detection automation.
Familiarity with governance, risk, and compliance frameworks (such as ISO 27001, ISO 27701, SOC 2, or PCI DSS), and an interest in encoding those requirements into technical controls and workflows.
Comfortable working with common security and IT tooling (for example, IAM, SIEM, EDR/MDR, ticketing, asset inventory) and stitching them together into coherent workflows.
Comfortable working in ambiguous, fast moving environments, prioritizing impact, and driving work to completion in a small, high ownership team.
Clear, concise communicator who can explain designs, tradeoffs, and implementation details and influence both technical and non-technical stakeholders.

Responsibilities

Build and automate security controls and workflows using scripts, tooling, and infrastructure (e.g., Python code).
Evaluate and integrate security tooling to improve capabilities or coverage.
Design and implement automation controls for compliance programs (ISO 27001, ISO 27701, SOC 2, and PCI DSS), including evidence collection, execution, and reporting.
Build and maintain integrations among security, IT, and cloud tools (e.g., SIEM, EDR/MDR, SOAR, ticketing, asset inventory) using APIs, webhooks, and SDKs.
Own technical delivery for security projects, from design and prototyping through implementation, documentation, and handoff.
Create and maintain reusable libraries, scripts, and modules for the security team and IT.
Design and implement logging and detection content to support incident investigations.
Participate in incident response efforts as a senior technical responder and adviser.
Support security operations and incident response by building collection scripts, queries, or ad hoc tooling.
Architect and improve controls across endpoint, identity, and SaaS environments (e.g., Okta/Google, Cyera, CrowdStrike).
Help define and implement baseline security configurations for corporate systems and services.
Encode policies and standards into technical guardrails.
Automate provisioning, hardening, and continuous monitoring in support of the identity lifecycle.
Build and maintain automation for organizational changes (join/move/leave) and monitoring of organizational drift.
Raise the security bar by translating policies and audit requirements into clear controls and runbooks.
Define practical metrics that reflect how controls are operating in production.