Storage Engineer Jobs

About The Position

Requirements

• At least 6 years of combined experience in software engineering, application security, product security, or a closely related field.
• Proficiency in most of the primary languages: C# .NET, TypeScript, JavaScript, and SQL.
• Experience securing web applications built on modern frameworks and cloud-native architectures, particularly AWS.
• Hands-on white-box testing and secure code review experience.
• Strong understanding of SSDLC principles and experience implementing or maturing secure development programs.
• Solid understanding of common vulnerabilities and attack techniques, including OWASP Top 10, API security, and authentication and authorization flaws.
• Experience integrating security tooling into delivery pipelines, such as GitHub, TeamCity, or similar.
• Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows.
• Risk-focused approach, including explaining security risks in business terms, balancing them against business needs and risk tolerance, and helping teams make pragmatic decisions.
• Proven ability to build trusted relationships with engineering teams and guide behavior without direct authority.
• Strong written and verbal communication skills, with the ability to communicate with engineers in design reviews and leadership in risk discussions.

Nice To Haves

• Development experience with Next.js, Vercel, or serverless architectures.
• Practical knowledge of security frameworks and standards such as OWASP ASVS, NIST 800-53, CIS v8, PCI DSS, or SOX.
• Hands-on security certifications such as OSCP, BSCP, GWEB, PNPT, or similar.
• Experience running or triaging a bug bounty program.
• Bachelor's degree in Computer Science, Information Security, or a related field.

Responsibilities

• Conduct security architecture and design reviews for new and evolving features, identifying risk early and recommending practical mitigations.
• Perform threat modeling and manual and automated code reviews, and partner with developers to prioritize and remediate findings.
• Drive a risk-based approach to application security and help teams understand vulnerabilities in terms of business impact.
• Mature the Secure SDLC, including secure coding standards, security requirements, and automated SAST, DAST, SCA, and secrets-scanning checks in CI/CD pipelines.
• Build and maintain security tooling and automation that scales across teams and reduces risk.
• Lead and develop the security champions program, training champions to provide security expertise within their teams.
• Serve as the application security subject matter expert for engineering, product, and leadership, and mentor engineers on secure development practices.
• Ensure AI tools and AI-powered features are adopted within acceptable risk limits.
• Align applications with SOC 1, SOX, CIS v8, and PCI DSS (SAQ-A, SAQ-P2PE), and support audits with evidence and remediation plans.