Senior Security Engineer

Engine

4d • Hybrid

About The Position

Engine is seeking a highly-skilled and motivated Senior Security Engineer to join our team. In this role, you will be a primary owner of the security and integrity of our company's applications and software systems. You will be responsible for building out a vulnerability management pipeline and executing our application security program. You will collaborate closely with engineering teams to ensure that Engine adheres to best practices in application security, tackling complex security repairs and ensuring our "engine" runs fast and securely.

Your Mission:
As part of the Engine team, you’ll play a vital role in an environment where innovation meets collaboration. You will drive work independently, syncing regularly to ensure quality and alignment across the following areas:
Threat Detection & SIEM Ownership: Own the configuration, tuning, and management of our SIEM solution. You will diagnose unusual threats through sophisticated analysis and develop the alerts needed to respond to security incidents across multiple layers.
Security Analysis & Reviews: Perform architecture reviews, code reviews, and infrastructure configuration reviews. You will conduct light penetration testing on web and mobile apps, identifying root causes of vulnerabilities and resolving them using creative problem-solving.
Vulnerability Management: Maintain and optimize a vulnerability management CI/CD pipeline within our container/application delivery infrastructure. You will adapt proven methods to align security goals with business objectives, even when guidance is light.
Cross-Functional Collaboration: Partner with development and infrastructure teams to enforce secure coding practices and remediation strategies. You will adapt your messaging across teams to reduce misalignment and move security work forward.
Implementation & Tooling: Build and maintain the frameworks and tooling for enterprise security, ensuring that security guidelines are clear and actionable for the broader engineering organization.
Incident Response: Play a key role in incident response and forensic investigations. You will weigh context and data thoughtfully to make smart decisions during high-pressure situations.
Security Advocacy: Stay current on the latest threats and provide direct, clear guidance to development teams. You will help develop security training to empower your peers and improve the team’s overall security posture.

Requirements

• Highly skilled in one or more programming languages (e.g., Ruby, Java, Python, C#, Node.js).
• Expertise in managing SIEM solutions with a focus on comprehensive, efficient alerting that reduces "noise."
• Strong knowledge of Docker and Kubernetes, with hands-on experience in automated container vulnerability management.
• Mastery of SAST, DAST, and IAST tools, with the ability to perform manual validation testing to confirm findings.
• Deep knowledge of the OWASP Top 10, Mitre Top 25, and secure coding practices.
• Ability to assess complex, ambiguous situations to identify root causes and provide thoughtful input on difficult security topics.
• A track record of earning credibility with peers through clear, direct communication and a passion for mentoring others.
• Experience working with cloud security concepts and compliance frameworks such as SOC 2 and PCI.

Responsibilities

• Own the configuration, tuning, and management of our SIEM solution.
• Diagnose unusual threats through sophisticated analysis and develop the alerts needed to respond to security incidents across multiple layers.
• Perform architecture reviews, code reviews, and infrastructure configuration reviews.
• Conduct light penetration testing on web and mobile apps, identifying root causes of vulnerabilities and resolving them using creative problem-solving.
• Maintain and optimize a vulnerability management CI/CD pipeline within our container/application delivery infrastructure.
• Adapt proven methods to align security goals with business objectives, even when guidance is light.
• Partner with development and infrastructure teams to enforce secure coding practices and remediation strategies.
• Adapt your messaging across teams to reduce misalignment and move security work forward.
• Build and maintain the frameworks and tooling for enterprise security, ensuring that security guidelines are clear and actionable for the broader engineering organization.
• Play a key role in incident response and forensic investigations.
• Weigh context and data thoughtfully to make smart decisions during high-pressure situations.
• Stay current on the latest threats and provide direct, clear guidance to development teams.
• Help develop security training to empower your peers and improve the team’s overall security posture.

Benefits

• Competitive base pay tied to role and experience, with opportunities for bonuses, commissions, and equity.
• Check out our full list at engine.com/culture.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed