Security Engineer

Vibes•Chicago, IL

2d•$110,000 - $120,000

About The Position

Vibes is building a company-wide security program covering its cloud environment, applications, workforce, and AI tools and agents. The Security Engineer will build, operate, and improve the controls that protect these areas, working hands-on with cloud infrastructure and code and partnering with Engineering, IT Support, and GRC. This generalist role carries ownership of both security engineering work and explaining risk and driving remediation across teams. The role reports to the Senior Security Engineer.

Requirements

At least 3 years of cybersecurity experience at a SaaS company, or equivalent.
Hands-on security engineering experience in a cloud environment; AWS is preferred.
Ability to read code and infrastructure as code, such as Terraform or CloudFormation and Python, Go, or TypeScript; identify security issues and provide constructive review feedback.
Practical experience with vulnerability management and incident response.
Solid understanding of IAM principles, including least privilege, RBAC, SSO, access reviews, and the joiner/mover/leaver lifecycle, as applied to people, service accounts, and agent identities.
Working knowledge of where AI systems introduce risk and where they can reduce work.
Strong written and verbal communication skills, including the ability to explain risk to any audience.

Nice To Haves

Relevant certification, such as CISSP or an AWS security certification.
Experience with SIEM, EDR, CSPM, vulnerability scanning, or identity provider (IdP) tooling.
Experience automating security workflows with scripting or APIs.
Hands-on experience evaluating or building LLM-based applications or agents.
Familiarity with frameworks such as NIST CSF, CIS Benchmarks, OWASP (including the LLM Top 10), or MITRE ATT&CK.
Experience running tabletop exercises or leading incidents.

Responsibilities

Engineer, operate, and improve cloud security controls for networking, identity, logging, encryption, and configuration baselines.
Improve security tooling coverage so active projects and accounts are represented in a single view, and track and close coverage gaps.
Define guardrails and secure defaults that make secure practices easy for engineering teams to adopt.
Manage vulnerability management end to end, including ingestion, triage, risk-based prioritization, assignment, and closure.
Agree on remediation timelines with owners, unblock fixes, and manage exceptions.
Report SLA performance, backlog age, and risk trends to security leadership.
Tune detections to improve signal and reduce noise, and respond to security events.
Write, maintain, and rehearse incident response runbooks.
Plan and conduct tabletop exercises and implement improvements based on lessons learned.
Build and improve access granting, review, and removal processes, including group-based access, provisioning automation, and periodic reviews.
Own security steps in joiner, mover, and leaver processes in partnership with GRC and IT Support.
Apply least privilege, role-based access, and SSO across people, service accounts, and agent identities.
Review code and infrastructure-as-code changes for security risks before production.
Convert recurring security findings into reusable patterns, secure templates, and automated checks, including in CI/CD.
Coach engineers on the significance of security findings and how to fix them.
Use language models and agents to strengthen workforce security, including triage, investigation support, and policy and access workflows.
Help secure an AI-enabled software development lifecycle, including controls for AI-generated code, agent permissions, and review gates.
Assess security of AI tools and agents, including their access to company systems and data, data handling, credential management, logging, prompt-injection risk, and data-exfiltration risk.
Explain risk clearly to engineers, executives, and auditors, adjusting detail and framing for each audience.
Support audits and compliance evidence requests in partnership with GRC, such as SOC 2 and ISO 27001.