Senior Security Engineer (2026)

Aptible

46d • $162,000 - $184,000

About The Position

In this role, you'll be a hands-on security engineer defending and hardening a platform that regulated companies build their businesses on. This is an engineering role first; you'll design security-by-default infrastructure, run our vulnerability management program, drive our pentesting program (including working with tools like XBOW) from finding to fix, and lead incident response when things go wrong. You'll also bring the organizational rigor to run a compliance recertification when the underlying technical controls are already sound, but this is not a policy-writing or audit-management role, and it's not the core of the job.
This role reports to the VP of Security, but works day-to-day in close collaboration with the Engineering team — not as a siloed security function reviewing work from a distance, but as an embedded partner co-owning the fixes, the infrastructure, and the outcomes.

Requirements

• 5+ years of experience in security engineering, with a track record of owning security-critical systems in production
• Experience as a hands-on security engineer, not just a security reviewer or policy writer — you can read and write code, operate infrastructure, and get into the weeds of a system under attack
• Communicate extremely well — clear, effective, and proactive, both in writing and live during an incident
• Strong engineering fundamentals and coding ability, with comfort working across a fullstack codebase — our stack includes Ruby on Rails, React/TypeScript, Go (Terraform client), and Ruby (CLI)
• Prolific and thoughtful developer in at least one mainstream language, and can pick up new languages/frameworks quickly
• Deep, hands-on experience with cloud infrastructure security (AWS strongly preferred), including AWS-native security tooling (e.g., AWS Security Agent, GuardDuty, Security Hub), and distributed systems
• Real pentesting experience, including with automated/AI-assisted tools like XBOW, and a track record of driving remediation rather than just reporting findings
• Experience running or significantly contributing to a vulnerability management program, from scanning and triage through verified remediation
• Experience leading or heavily participating in incident response — you stay calm and methodical under pressure
• Comfort working across identity management, network security, and detection tooling
• Organized enough to run a compliance recertification as a project — tracking evidence, coordinating stakeholders, and hitting deadlines — without that becoming your whole job
• Know the difference between operating existing controls well and designing net-new policy, and you're energized by the former
• Want to be part of a small, highly collaborative team, and you work closely with Engineering rather than operating at arm's length
• Don't let ambiguity or bumps in the road stop you: you identify what's blocking you, take ownership, and drive to get unblocked
• Appreciate working in a highly autonomous, trusted role, where the day to day priorities may shift.
• Want to do hands-on security engineering, designing, building, breaking, and fixing in real code — not just governance and paperwork
• Deeply curious problem solver, and you're not tied to a specific language or technology
• Energized by incident response, vulnerability management, and pentesting, and see compliance as something you keep running smoothly, not something you build from scratch
• Invested in team ownership — you care about what your teammates are building, not just your own corner

Nice To Haves

• Developer tools or platform engineering experience is a plus

Responsibilities

• Design and build security-by-default infrastructure across our AWS-based PaaS, which spans Ruby on Rails backend systems, a web app (React-TypeScript), a Terraform client (Go), a CLI client (Go), and several other distributed components (Python, Go, Ruby)
• Own and mature our vulnerability management program — triaging findings and working findings from scanning tools and the AWS Security Agent in collaboration with the Engineering team, prioritizing by real-world exploitability and risk
• Own our pentesting program end to end — running automated assessments with XBOW, coordinating manual and third-party testing, and driving remediation to closure in our codebase (Ruby, Go, TypeScript) and infrastructure alongside Engineering, rather than just filing tickets and waiting
• Lead incident response operations: detection, containment, eradication, and post-incident review, with a bias toward fixing root causes in the code and infrastructure, not just symptoms
• Build and maintain detection tooling, alerting, and runbooks — including tuning and extending the AWS Security Agent — to reduce time-to-response
• Participate in on-call rotation for security-relevant incidents and help drive follow-ups that prevent repeats
• Run point on compliance recertifications and maintaining current standards (e.g., renewing SOC 2 or HITRUST) when the technical controls are already in place, this means being organized, coordinating evidence collection, and working with auditors, not authoring new policy from scratch
• Use AI tools to improve your development and investigation workflow

Benefits

• Aptible's Employee Benefits

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed