Senior Security Engineer
About The Position
Bastion is seeking a hands-on Senior Security Engineer to join their security team as its second engineer. This role reports to the CTO/CISO and will work alongside the Staff Security Engineer. The company has a strong security foundation, including a SOC 2 Type II report, conditional approval from the OCC for a national trust charter, a SIEM and detection pipeline, runtime security for Kubernetes, and auditable access to production. The engineer will help scale this program across security engineering, infrastructure, product and application security, detection and response, and the technical side of GRC (SOC 1, SOC 2, OCC, and MiCA/DORA). As part of a 40-person company, the work will directly protect users and partners. The platform is primarily Go, running on Kubernetes (EKS) in AWS and managed with Terraform, with security services also written in Go. The role requires the ability to write production code, with expectations to spend most of the time writing code, reviewing design docs, and building security tooling and middleware that engineers can easily integrate into services. The role can be remote within the US, with a preference for candidates in NYC or open to relocation.
Requirements
- Must be able to write production code
- Experience with Go codebase
- Experience with AWS and Kubernetes environment
- Experience with SIEM
- Experience with security services
- Experience with incident response and on-call procedures
- Experience with DLP program
- Experience owning a security domain end to end (e.g., Kubernetes and cloud hardening, application security in CI, or detection engineering)
- Experience writing and tuning detections as code
- Experience adding new telemetry sources
- Experience reducing alert noise
- Experience writing reusable security libraries or middleware in Go (e.g., authorization, tenant isolation, request signing, or input validation)
- Experience being a security reviewer on design docs
- Experience delivering control automation and evidence for audits or regulatory workstreams (SOC 1, SOC 2, OCC)
- Experience launching and triaging bug bounty programs
- Experience growing DLP coverage and policies
- Experience driving multi-quarter initiatives (e.g., default-deny service-to-service networking, security policy evaluation, just-in-time, granular access)
- Experience expanding Kubernetes cluster and container security (image scanning and signing, admission policies, pod security standards, runtime protection)
- Experience growing shared security middleware and libraries
- Experience expanding compliance scope with automation
- Experience turning tabletop exercises and resilience testing into concrete fixes
- Experience joining cross-functional planning and influencing security roadmaps
- Experience building reusable security building blocks
- Experience protecting critical systems at the core of a regulated stablecoin platform
- Experience turning regulatory requirements into engineered, tested, and continuously evidenced controls
- Experience building high-signal detections across cloud, Kubernetes, identity, endpoint, and SaaS telemetry
- Experience hardening Kubernetes clusters and container supply chain without slowing deploys
Nice To Haves
- Second engineer on the security team
Responsibilities
- Get hands-on with our Go codebase, AWS and Kubernetes environment, SIEM, and security services
- Contribute security feedback to at least one engineering design doc
- Ship your first security fix, guardrail, or detection to production
- Learn our incident response and on-call procedures, and join our security rotation
- Get up to speed on our DLP program and start contributing to its rollout
- Own at least one security domain end to end, such as Kubernetes and cloud hardening, application security in CI, or detection engineering
- Write and tune detections as code, add new telemetry sources, and reduce alert noise
- Ship your first reusable security library or middleware in Go (for example authorization, tenant isolation, request signing, or input validation) and get it adopted by at least one service team
- Be the security reviewer on design docs for new product features and architecture changes
- Deliver control automation and evidence for an active audit or regulatory workstream (SOC 1, SOC 2, OCC)
- Help launch and triage our bug bounty program, and grow our DLP coverage and policies
- Drive multi-quarter initiatives such as default-deny service-to-service networking, security policy evaluation, or just-in-time, granular access across more systems
- Expand our Kubernetes cluster and container security, including image scanning and signing, admission policies, pod security standards, and runtime protection
- Grow a shared set of security middleware and libraries that is adopted across the codebase, so the secure path is the easy path for our Go engineers
- Help expand our compliance scope with automation instead of spreadsheets
- Turn tabletop exercises and resilience testing into concrete fixes
- Join cross-functional planning and influence the security roadmap
- Building reusable security building blocks that make secure defaults easy across our platform
- Protecting the critical systems at the core of a regulated stablecoin platform
- Turning OCC and MiCA/DORA requirements into controls that are engineered, tested, and continuously evidenced
- Building high-signal detections across cloud, Kubernetes, identity, endpoint, and SaaS telemetry
- Hardening our Kubernetes clusters and container supply chain, from build to admission to runtime, without slowing deploys
Benefits
- Equal employment opportunities to all employees and applicants for employment
- Prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws
- Participates in E-Verify to authorize eligibility of employment in the United States
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
