Security Engineer

Bright Machines•Burlingame, CA

19d•$170,000 - $200,000

About The Position

As part of the IT organization, the Security Engineer executes and enforces Bright Machines’ day-to-day information security program across corporate, product, and manufacturing environments, spanning platform security, application security, and information security compliance. The role partners with the Global IT Director, who sets security policy and strategy, and owns hands-on execution. It also works closely with the Infrastructure Engineer on network security execution and Platform Engineering on application security. The Security Engineer maintains the company’s existing ISO 27001:2022 certification and handles customer security requirements that support commercial relationships. Strong written and verbal English communication is essential for daily collaboration with IT, Platform Engineering, Software Development, and Delivery.

Requirements

At least 5 years of experience in security engineering, IT security, application security, or a closely related role.
Experience maintaining an existing ISO 27001 ISMS, including evidence collection, internal audits, and support for surveillance and recertification audits.
Working knowledge of application security fundamentals, including OWASP Top 10 and secure SDLC practices.
Hands-on experience with SAST/DAST/SCA tools; examples include Snyk, Semgrep, Checkmarx, and Burp Suite.
Proficiency in a scripting language such as Python for security automation, and a strong inclination toward infrastructure-as-code tools such as Terraform or Ansible for codifying and enforcing security controls.
Familiarity with GRC platforms for compliance evidence and monitoring.
Basic cloud security literacy in AWS, Azure, and/or GCP, including IAM, network security groups, encryption, logging, and monitoring.
Comfort completing customer security questionnaires and supporting customer-facing security conversations under direction.
Familiarity with EDR/managed SOC platforms and comfort participating in security operations and detection/response workflows.
Excellent written and verbal English communication skills, with the ability to communicate clearly with IT, Platform Engineering, Software Development, and Delivery stakeholders.
Comfort working as an execution-focused security practitioner in a lean IT organization and partnering closely with the Global IT Director, Infrastructure Engineer, Platform Engineering, and staff IT Engineers.

Nice To Haves

Security certifications such as Security+, GSEC, or CCSP.
Experience in manufacturing, industrial, IoT, or OT/ICS security environments.
Exposure to penetration-testing engagements, either hands-on or coordinating with external testers.
Familiarity with Zero Trust architecture principles.
English language proficiency.

Responsibilities

Execute day-to-day information security operations across corporate IT, platform, and product environments, in partnership with the Global IT Director.
Maintain the existing ISO 27001:2022 certification by managing evidence collection, internal audits, and corrective actions, and supporting annual surveillance and recertification audits.
Complete customer security due diligence, including security questionnaires such as SIG and CAIQ; support customer audits and track contractual security requirements in partnership with Legal and Sales as needed.
Partner with Platform Engineering to integrate application security into the SDLC, including threat-modeling support, secure-code-review guidance, and operation of SAST/DAST/SCA tools.
Run vulnerability management across applications and platform infrastructure, including scanning, triage, and driving remediation with engineering teams to SLA.
Coordinate third-party penetration tests and security assessments, and track findings through closure.
Partner with the Infrastructure Engineer on network and compute infrastructure security, including EDR/managed SOC and network IDS/IPS controls, and align application and platform controls with network security architecture.
Support security incident response by maintaining the incident response plan, participating in investigations, and conducting periodic tabletop exercises.
Support identity and access governance for corporate and platform systems, including access reviews, certifications, and MFA/SSO enforcement, with IT Engineering.
Conduct security risk assessments for new vendors, tools, and third-party integrations.
Maintain information security policies, standards, and employee security awareness training, including phishing simulations, in line with direction from the Global IT Director.
Track and report security posture, risk, and compliance status to the Global IT Director.
Help evaluate and prepare for future compliance initiatives, such as SOC 2 Type II, as prioritized by leadership.