Security Engineer
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Security Engineer operating Firmable’s SOC 2 and ISO 27001 security controls. Managing AWS cloud security, vulnerabilities, access, monitoring, audits and incident response remotely.
Responsibilities:
- Implement and maintain SOC 2 and ISO 27001 controls across infrastructure, applications and internal systems
- Close control gaps as they are identified
- Enforce information security policies across engineering and business teams
- Manage access control, data classification, incident response, vendor risk and change management practices
- Perform continuous control monitoring, including recurring access reviews, log reviews, vulnerability scans and patch cadence checks
- Organize evidence ahead of audits
- Triage vulnerability scanner findings, coordinate remediation with engineering and verify closure
- Manage onboarding/offboarding, least-privilege access, MFA enforcement and periodic access recertification
- Monitor security alerts and logs, triage and escalate incidents according to the incident response plan
- Maintain the risk register and third-party risk assessments and track remediation to closure
- Prepare evidence for annual assessments and respond to customer security questionnaires
- Run employee security training and phishing simulations
- Partner with engineering on AWS secure cloud configuration, least-privilege IAM, encryption and secrets management
- Report into the Security & Compliance team
- Spend approximately 90% of time on hands-on execution and 10% on cross-functional work
Requirements:
- 2–5 years in security engineering, cloud security or infrastructure security
- Ideally direct SOC 2 or ISO 27001 exposure
- Working knowledge of the SOC 2 Trust Services Criteria and mapping technical controls to them
- Hands-on cloud security fundamentals, preferably AWS
- Experience with IAM, logging/monitoring and vulnerability scanning
- Comfortable executing security policy day to day, including access reviews, evidence collection and remediation tracking
- Clear written communication
- Comfortable working asynchronously across time zones with a distributed team
- Familiarity with GRC automation platforms such as Vanta or Drata is highly valued
- Relevant certification such as Security+, CySA+, ISO 27001 Lead Implementer, or progress toward CISA/CISSP is highly valued
Benefits:
- Competitive compensation
- Flexible hours
- Fully remote work
- Global, distributed team environment
- Real ownership over security controls
- Multi-framework exposure to SOC 2 and ISO 27001 programs
- Professional exposure to a fast-moving, AI-native product team
Similar Jobs
Security Engineer IV
Security Engineer IV leading AI/LLM security, cloud controls, compliance, and incident investigations. Rackspace Technology operates enterprise AI infrastructure for regulated and mission-critical customers.
Regional Sales Director, Identity Security
Regional Sales Director leading Mid-Atlantic and TOLA sales teams for Cyera’s AI security platform. Driving territory growth, enterprise deals, coaching, and quota achievement.
AVP, Cyber Application Security Architect
Cyber application security architect securing SaaS, cloud infrastructure, and software development lifecycles. Driving secure-by-design reviews, DevSecOps, threat modeling, and AI/ML security guidance.
Senior Cybersecurity Disaster Recovery, Contingency Planning SME
Cybersecurity DRCP SME leading nationwide BIA, DRP, and contingency planning programs. Supporting government agencies in strengthening national security and improving public services.
Cloud Specialist – Security SSR
Cloud Security Specialist securing AWS infrastructure for major Latin American companies. Designing AWS governance, network protection, compliance, automation, and incident remediation.
Senior Cybersecurity Architect
Senior Cybersecurity Architect governing Zero Trust, AWS, DevSecOps, and AI security architecture. Reducing cyber risk across HomeServe’s home-services technology and integrations.
Senior Cybersecurity Engineer
Senior Cybersecurity Engineer securing HomeServe’s enterprise systems, infrastructure, and business operations. Leading risk assessments, security architecture, incident response, compliance, and cybersecurity innovation.
AWS Cloud Security Engineer
AWS Cloud Security Engineer securing Peraton’s FedRAMP-authorized AWS infrastructure. Implementing cloud controls, continuous compliance, and ATO support for national security missions.
Security Engineer – CrowdStrike Falcon
Senior CrowdStrike CNAPP engineer configuring cloud, Kubernetes, and container security for a cybersecurity consulting firm. Securing government and enterprise environments through hands-on Falcon implementation.
Technical Advisor II – Food Security, Livelihoods and Markets
Remote CRS technical advisor leading Sudan’s World Bank-funded Food and Nutrition Security Plan. Advising global food security, livelihoods, and market-based humanitarian programming.
Manager, Application Security, SOX
Application Security and SOX Manager securing Oracle Fusion, EPM, and OIC environments. Ensuring access governance, Segregation of Duties, and compliance for Paramount’s global media business.
Senior Manager, Application and Pipeline Security
Senior Manager leading Nielsen’s application and pipeline security for its media insights business. Driving AWS governance, AI-driven DevSecOps, automated remediation, and security engineering team performance.
Senior Security Engineer
Senior Security Engineer monitoring and responding to threats across Cision’s cloud, identity, endpoint, and Linux environments. Cision provides PR, marketing, and social media management technology.
Information Security Control Assurance Analyst
Information security analyst assuring controls, audits, and compliance for Southern New Hampshire University. Managing risk assessments, SSPs, POA&Ms, audits, and governance reporting remotely.
Security Engineer – Manager
Security Engineering Manager leading zero-trust, IAM, collaboration, and AI workspace security for Binance’s global blockchain ecosystem. Building secure platforms and leading distributed engineering teams.
Principal Security Engineer
Principal Security Engineer reviewing FedRAMP cloud architectures, authorization packages, and security controls. Advising government programs and Cloud Service Providers on NIST compliance and risk.
Senior Cybersecurity Risk & Resilience Consultant
Senior cybersecurity risk consultant assessing technology, cloud, and third-party risks. Strengthening risk frameworks and advising stakeholders on resilience, compliance, and remediation.
Senior Cybersecurity Governance Consultant
Senior Cybersecurity Governance Consultant strengthening an organization’s cybersecurity frameworks, policies, controls, and compliance. Managing governance reporting, exceptions, audits, and regulatory-readiness initiatives.
Cybersecurity Compliance, Technical Controls Consultant
Cybersecurity consultant assessing technical controls, cloud, infrastructure, and regulatory compliance. Managing audits, remediation, evidence, policies, and metrics for a two-year engagement.
Fraud Security Specialist
Fraud Security Specialist protecting CoinPoker’s blockchain-based crypto-poker platform from fraud, money laundering, cheating, and account abuse. Investigating cases, managing transaction queues, and reporting fraud trends.