Security Engineer

Vibes•Chicago, IL

About The Position

Vibes is building a company-wide security program spanning its cloud environment, applications, workforce, and AI tools and agents. The Security Engineer will build, operate, and improve the controls that protect these areas. This is a hands-on generalist role with ownership of security engineering work and responsibility for explaining risk and driving remediation across teams. The engineer will work closely with engineering, IT Support, and GRC and help shape secure AI adoption. The role reports to the Senior Security Engineer.

Requirements

At least 3 years of cybersecurity experience at a SaaS company, or equivalent.
Hands-on security engineering experience in a cloud environment; AWS is preferred.
Comfort reading code and infrastructure as code, such as Terraform or CloudFormation, and languages such as Python, Go, or TypeScript; able to identify security issues and provide constructive review feedback.
Practical experience with vulnerability management and incident response.
Solid understanding of IAM principles, including least privilege, RBAC, SSO, access reviews, and the joiner/mover/leaver lifecycle, applied to people, service accounts, and agent identities.
Working knowledge of where AI systems introduce risk and where they can reduce work.
Strong written and verbal communication skills, including the ability to explain risk to any audience.

Nice To Haves

Relevant certification, such as CISSP or an AWS security certification.
Experience with SIEM, EDR, CSPM, vulnerability-scanning, or IdP tooling.
Experience automating security workflows with scripting or APIs.
Hands-on experience evaluating or building LLM-based applications or agents.
Familiarity with frameworks such as NIST CSF, CIS Benchmarks, OWASP (including the LLM Top 10), or MITRE ATT&CK.
Experience running tabletop exercises or leading incidents.

Responsibilities

Engineer, operate, and improve cloud security controls covering network, identity, logging, encryption, and configuration baselines.
Improve security-tooling coverage so active projects and accounts report to a unified view, and track and close coverage gaps.
Define guardrails and secure defaults that make secure practices easier for engineering teams.
Run vulnerability management end to end, including ingestion, triage, real-world risk prioritization, assignment, and closure.
Work with remediation owners to set timelines, unblock fixes, and handle exceptions.
Report SLA performance, backlog age, and risk trends to security leadership.
Tune detections to improve signal and reduce noise, and respond to security events.
Write, maintain, and rehearse incident response runbooks.
Plan and run tabletop exercises and turn lessons learned into concrete improvements.
Take part in the security on-call rotation, if applicable.
Build and improve access-granting, review, and removal processes, including group-based access, provisioning automation, and periodic access reviews.
Own security steps in joiner, mover, and leaver processes in partnership with GRC and IT Support.
Apply least privilege, role-based access, and SSO consistently across people, service accounts, and agent identities.
Review code and infrastructure-as-code changes for security risk before production.
Turn recurring findings into reusable patterns, secure templates, and automated checks, such as CI/CD checks.
Coach engineers on the importance of security findings and how to address them.
Use language models and agents to strengthen workforce security, including triage, investigation support, and policy and access workflows.
Support securing an agentic, AI-leaning software development lifecycle, including controls for AI-generated code, agent permissions, and review gates.
Assess the security of AI tools and agents, whether bought or built, including access to company systems and data, data handling, credential management, logging, prompt-injection risk, and data-exfiltration risk.
Explain risk clearly to engineers, executives, and auditors, tailoring the depth and framing to each audience.
Support audits and compliance evidence requests with GRC, such as SOC 2 and ISO 27001.