Senior Security Engineer

Later•Boston, MA

15d

About The Position

Later is seeking a Senior Security Engineer to strengthen company-wide security through hands-on engineering, collaboration, and practical standards. The role spans application, cloud, infrastructure, corporate systems, and business operations security, with an emphasis on secure development, vulnerability management, compliance enablement, and improving security practices across the company. The engineer will work with Engineering, Infrastructure, Product, IT, Legal, People, Finance, and other business teams to incorporate security into systems, tools, workflows, and operating practices. A central objective is to mature security capabilities in support of SOC 2 and related compliance expectations. This includes implementing practical, automated controls, maintaining reliable audit evidence processes, and providing guidance that works for technical and non-technical teams. The role calls for a senior security practitioner who combines defensive security judgment with software engineering skills and leads through influence. Success includes assessing the security posture and establishing a stakeholder-reviewed remediation roadmap during the first 90 days; documenting and automating core SOC 2 controls and reliable evidence collection by six months; integrating and maintaining scanning, secret management, and container security in CI/CD; and improving security observability and incident response readiness. The position is open in Boston, MA; Vancouver, BC; and Vancouver, WA, with fully remote work available for select positions.

Requirements

5–7+ years of experience as a Security Engineer or Software Engineer with a strong security focus.
Proven ability to build and operate production-quality software, automation, and internal tooling.
Strong understanding of application security, infrastructure security, cloud security, secure CI/CD practices, and corporate security controls.
Hands-on experience with vulnerability management, secure software development, threat modeling, remediation workflows, and operational security improvements.
Experience with security frameworks and standards such as OWASP, NIST, CIS Controls, SOC 2, and ISO 27001, and applying them in production and business environments.
Experience supporting SOC 2 compliance through practical, automated, and auditable controls.
Experience with SIEM/SOAR tools, logging and monitoring platforms, detection workflows, and practical incident response processes.
Experience with Infrastructure-as-Code security scanning for tools such as Terraform or CloudFormation.
Ability to translate complex security concepts into clear, actionable guidance for technical and non-technical audiences.
Experience collaborating closely with engineering, IT, compliance, and business teams to improve security outcomes.

Nice To Haves

Familiarity with cloud security platforms such as AWS Security Hub, Azure Security Center, or GCP Security Command Center.
Familiarity with C#, modern backend systems, cloud-native architecture, and SaaS business tooling.

Responsibilities

Assess and continuously improve security across applications, infrastructure, cloud environments, corporate systems, vendor tooling, and business workflows.
Define and implement scalable security standards, best practices, and guardrails that support SOC 2 readiness through practical, automated, and auditable solutions.
Partner with Engineering, Infrastructure, IT, Product, Legal, People, Finance, and business leaders to align security priorities with company goals, risk reduction, and delivery timelines.
Translate SOC 2 and related compliance requirements into sustainable technical and operational controls, procedures, and evidence collection practices.
Identify security gaps, prioritize remediation, and help teams make pragmatic, risk-based decisions.
Support company-wide security awareness, secure operating practices, and adoption of security controls across business teams.
Build and maintain internal security tools, automation, and services for secure development, compliance workflows, vulnerability management, corporate security operations, and operational visibility.
Design and implement CI/CD security controls, including secure build and deployment patterns, security scanning, dependency management, container scanning, and secret management.
Support application security through secure design reviews, threat modeling, code review guidance, API security, microservices security patterns, and remediation planning.
Improve cloud infrastructure and corporate systems security through hardening, monitoring, configuration reviews, Infrastructure-as-Code security scanning, access reviews, and secure operational patterns.
Collaborate with technical and business teams to identify vulnerabilities and control gaps, explain their impact, and drive remediation.
Improve security observability and response readiness through logging, alerting, detection engineering, incident response improvements, and security process maturity.
Provide pragmatic security guidance on designs, implementations, vendor tools, operational practices, and business workflows.
Communicate security risks, tradeoffs, and recommendations clearly to technical and non-technical audiences.
Embed security into development workflows, corporate systems, and company operating practices without unnecessarily slowing teams.
Coordinate cross-functionally to support SOC 2 and related compliance through automation, well-defined controls, and reliable evidence practices.