Job Description JOB DESCRIPTION Contribute to leading-edge security and resilience efforts, advancing protective strategies and propelling continuous improvement. As an Assessments & Exercises Vice President in the Cybersecurity and Technology Controls line of business, you will contribute significantly to enhancing the firm's cybersecurity or resiliency posture by using industry-standard assessment methodologies and techniques to proactively identify risks and vulnerabilities in people, processes, and technology. Design and deploy risk-driven tests and simulations (or manage a highly skilled team that does) and inform analysis to clearly outline root-causes. In this role, you will evaluate preventative controls, incident response processes, and detection capabilities, and advise cross-functional teams on security strategy and risk management. JPMC's Assessment Operations organization is looking to expand its Cybersecurity Red Team with an experienced Business Process Red Team Operator specialized in social engineering, penetration testing, Artificial Intelligence, and assessments of critical business processes such as payment operations, fraud, and supplier management. The primary focus of this role will be to perform and manage hands-on offensive security activities as part of Red Team engagements against critical JPMC assets. The successful candidate will have a proven track record in cybersecurity assessments, to include social engineering operations like phishing and vishing, and will be able to demonstrate knowledge of computer networking fundamentals, modern threats and vulnerabilities, attack methodologies, and penetration testing tools. The Cybersecurity Red Team consists of highly skilled and qualified members who conduct advanced adversary emulation operations to replicate cybersecurity threats targeting the firm. This position is anticipated to require the use of one or more High Risk Role (HRR) systems, which mandates successful completion of enhanced screening, including criminal and credit background checks, before starting employment and annually thereafter. Job responsibilities Perform and manage hands-on offensive security activities leveraging social engineering skillsets as part of Red Team engagements against critical JPMC assets Conduct business process assessments to include tabletop or workshop sessions, live testing of business process controls by technical and social engineering attacks, and preparation of deliverables for senior stakeholders Design and execute testing and simulations - such as penetration tests, technical controls assessments, cyber exercises, or resiliency simulations, and contribute to the development and refinement of assessment methodologies, tools, and frameworks to ensure alignment with the firm's strategy and compliance with regulatory requirements Evaluate controls for effectiveness and impact on operational risk, as well as opportunities to automate control evaluation Collaborate closely with cross-functional teams to develop comprehensive assessment reports - including detailed findings, risk assessments, and remediation recommendations - making data-driven decisions that encourage continuous improvement Utilize threat intelligence and security research to stay informed about emerging threats, vulnerabilities, industry best practices, and regulations. Apply this knowledge to enhance the firm's assessment strategy and risk management. Engage with peers and industry groups that share threat intelligence analytics Required qualifications, capabilities, and skills 5+ years of experience in cybersecurity or resiliency, with demonstrated exceptional organizational skills to plan, design, and coordinate the development of offensive security testing, assessments, or simulation exercises Knowledge of US financial services sector cybersecurity or resiliency organization practices, operations risk management processes, principles, regulations, threats, risks, and incident response methodologies Ability to identify systemic security or resiliency issues as they relate to threats, vulnerabilities, or risks, with a focus on recommendations for enhancements or remediation, and proficiency in multiple security assessment methodologies (e.g., Open Worldwide Application Security Project (OWASP) Top Ten, National Institute of Standards and Technology (NIST) Cybersecurity Framework), offensive testing tools, or resiliency testing equivalents Excellent communication, collaboration, and report writing skills, with the ability to influence and engage stakeholders across various functions and levels Candidate should have the ability to perform targeted, covert security tests with vulnerability identification, exploitation, and post-exploitation activities Strong understanding of the following: Networking fundamentals (all OSI layers, protocols); Windows/ Linux/Unix/Mac operating systems as well as software vulnerability and exploitation techniques; commercial or open-source offensive security tools for reconnaissance, scanning, exploitation, and post-exploitation (e.g. Cobalt Strike, Metasploit, Nmap, Nessus, Burp Suite) Familiarity with AI/ML technologies and tools and operationalizing their use in Red Teaming (e.g., developing video and audio deepfakes, etc.), as well as with system administration skills such as configuration, maintenance, and interpretation of log output from networking devices, operating systems, and infrastructure services and with cloud architecture, operations, and security vulnerabilities Ability to collaborate with high-performing teams and individuals throughout the firm to accomplish common goals Broad experience in multiple businesses or verticals, with organizational and cultural understanding of call centers, payments processes, client service/sales organizations, and operational support staff The ability to articulate and visually present complex technical and fraud subject matter to a wide and senior audience Ability to analyze and produce reports about cybersecurity and fraud vulnerabilities, threats, designs, and procedures Preferred qualifications, capabilities, and skills Social engineering background (or intelligence, law enforcement, or similar experience) Experience in fraud detection and prevention, with a proven track record in identifying, analyzing, and mitigating fraud risks within financial systems or similar environments. Understanding of relevant regulations and compliance requirements related to fraud prevention, such as AML (Anti-Money Laundering) and KYC (Know Your Customer) standards Relevant certifications such as those offered by Offensive Security (OSCP, OSEP), CREST (Certified Simulated Attack Specialist), SANS (GPEN, GWAPT), fraud-specific certifications such as Certified Fraud Examiner or Certified Anti-Money Laundering Specialist (CAMS) Technical knowledge such as: developing in-house scripting; using interpreted languages (such as Ruby, Python, or Perl) and compiled languages (such as C, C++, C#, or Java); understanding security tools or technology such as firewalls, IDS/IPS, web proxies, and DLP Information Security experience in two or more of the following verticals: fraud operations, threat modeling, network/application security testing, social engineering, Red Team operations, and network exploitation operations Ability to support and grow skillsets for Cybersecurity Red Team operations ABOUT US JPMorganChase, one of the oldest financial institutions, offers innovative financial solutions to millions of consumers, small businesses and many of the world's most prominent corporate, institutional and government clients under the J.P. Morgan and Chase brands. Our history spans over 200 years and today we are a leader in investment banking, consumer and small business banking, commercial banking, financial transaction processing and asset management. We offer a competitive total rewards package including base salary determined based on the role, experience, skill set and location. Those in eligible roles may receive commission-based pay and/or discretionary incentive compensation, paid in the form of cash and/or forfeitable equity, awarded in recognition of individual achievements and contributions. We also offer a range of benefits and programs to meet employee needs, based on eligibility. These benefits include comprehensive health care coverage, on-site health and wellness centers, a retirement savings plan, backup childcare, tuition reimbursement, mental health support, financial coaching and more. Additional details about total compensation and benefits will be provided during the hiring process. We recognize that our people are our strength and the diverse talents they bring to our global workforce are directly linked to our success. We are an equal opportunity employer and place a high value on diversity and inclusion at our company. We do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. We also make reasonable accommodations for applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs. Visit our FAQs for more information about requesting an accommodation. JPMorgan Chase & Co. is an Equal Opportunity Employer, including Disability/Veterans ABOUT THE TEAM . click apply for full job details
11/08/2026
Full time
Job Description JOB DESCRIPTION Contribute to leading-edge security and resilience efforts, advancing protective strategies and propelling continuous improvement. As an Assessments & Exercises Vice President in the Cybersecurity and Technology Controls line of business, you will contribute significantly to enhancing the firm's cybersecurity or resiliency posture by using industry-standard assessment methodologies and techniques to proactively identify risks and vulnerabilities in people, processes, and technology. Design and deploy risk-driven tests and simulations (or manage a highly skilled team that does) and inform analysis to clearly outline root-causes. In this role, you will evaluate preventative controls, incident response processes, and detection capabilities, and advise cross-functional teams on security strategy and risk management. JPMC's Assessment Operations organization is looking to expand its Cybersecurity Red Team with an experienced Business Process Red Team Operator specialized in social engineering, penetration testing, Artificial Intelligence, and assessments of critical business processes such as payment operations, fraud, and supplier management. The primary focus of this role will be to perform and manage hands-on offensive security activities as part of Red Team engagements against critical JPMC assets. The successful candidate will have a proven track record in cybersecurity assessments, to include social engineering operations like phishing and vishing, and will be able to demonstrate knowledge of computer networking fundamentals, modern threats and vulnerabilities, attack methodologies, and penetration testing tools. The Cybersecurity Red Team consists of highly skilled and qualified members who conduct advanced adversary emulation operations to replicate cybersecurity threats targeting the firm. This position is anticipated to require the use of one or more High Risk Role (HRR) systems, which mandates successful completion of enhanced screening, including criminal and credit background checks, before starting employment and annually thereafter. Job responsibilities Perform and manage hands-on offensive security activities leveraging social engineering skillsets as part of Red Team engagements against critical JPMC assets Conduct business process assessments to include tabletop or workshop sessions, live testing of business process controls by technical and social engineering attacks, and preparation of deliverables for senior stakeholders Design and execute testing and simulations - such as penetration tests, technical controls assessments, cyber exercises, or resiliency simulations, and contribute to the development and refinement of assessment methodologies, tools, and frameworks to ensure alignment with the firm's strategy and compliance with regulatory requirements Evaluate controls for effectiveness and impact on operational risk, as well as opportunities to automate control evaluation Collaborate closely with cross-functional teams to develop comprehensive assessment reports - including detailed findings, risk assessments, and remediation recommendations - making data-driven decisions that encourage continuous improvement Utilize threat intelligence and security research to stay informed about emerging threats, vulnerabilities, industry best practices, and regulations. Apply this knowledge to enhance the firm's assessment strategy and risk management. Engage with peers and industry groups that share threat intelligence analytics Required qualifications, capabilities, and skills 5+ years of experience in cybersecurity or resiliency, with demonstrated exceptional organizational skills to plan, design, and coordinate the development of offensive security testing, assessments, or simulation exercises Knowledge of US financial services sector cybersecurity or resiliency organization practices, operations risk management processes, principles, regulations, threats, risks, and incident response methodologies Ability to identify systemic security or resiliency issues as they relate to threats, vulnerabilities, or risks, with a focus on recommendations for enhancements or remediation, and proficiency in multiple security assessment methodologies (e.g., Open Worldwide Application Security Project (OWASP) Top Ten, National Institute of Standards and Technology (NIST) Cybersecurity Framework), offensive testing tools, or resiliency testing equivalents Excellent communication, collaboration, and report writing skills, with the ability to influence and engage stakeholders across various functions and levels Candidate should have the ability to perform targeted, covert security tests with vulnerability identification, exploitation, and post-exploitation activities Strong understanding of the following: Networking fundamentals (all OSI layers, protocols); Windows/ Linux/Unix/Mac operating systems as well as software vulnerability and exploitation techniques; commercial or open-source offensive security tools for reconnaissance, scanning, exploitation, and post-exploitation (e.g. Cobalt Strike, Metasploit, Nmap, Nessus, Burp Suite) Familiarity with AI/ML technologies and tools and operationalizing their use in Red Teaming (e.g., developing video and audio deepfakes, etc.), as well as with system administration skills such as configuration, maintenance, and interpretation of log output from networking devices, operating systems, and infrastructure services and with cloud architecture, operations, and security vulnerabilities Ability to collaborate with high-performing teams and individuals throughout the firm to accomplish common goals Broad experience in multiple businesses or verticals, with organizational and cultural understanding of call centers, payments processes, client service/sales organizations, and operational support staff The ability to articulate and visually present complex technical and fraud subject matter to a wide and senior audience Ability to analyze and produce reports about cybersecurity and fraud vulnerabilities, threats, designs, and procedures Preferred qualifications, capabilities, and skills Social engineering background (or intelligence, law enforcement, or similar experience) Experience in fraud detection and prevention, with a proven track record in identifying, analyzing, and mitigating fraud risks within financial systems or similar environments. Understanding of relevant regulations and compliance requirements related to fraud prevention, such as AML (Anti-Money Laundering) and KYC (Know Your Customer) standards Relevant certifications such as those offered by Offensive Security (OSCP, OSEP), CREST (Certified Simulated Attack Specialist), SANS (GPEN, GWAPT), fraud-specific certifications such as Certified Fraud Examiner or Certified Anti-Money Laundering Specialist (CAMS) Technical knowledge such as: developing in-house scripting; using interpreted languages (such as Ruby, Python, or Perl) and compiled languages (such as C, C++, C#, or Java); understanding security tools or technology such as firewalls, IDS/IPS, web proxies, and DLP Information Security experience in two or more of the following verticals: fraud operations, threat modeling, network/application security testing, social engineering, Red Team operations, and network exploitation operations Ability to support and grow skillsets for Cybersecurity Red Team operations ABOUT US JPMorganChase, one of the oldest financial institutions, offers innovative financial solutions to millions of consumers, small businesses and many of the world's most prominent corporate, institutional and government clients under the J.P. Morgan and Chase brands. Our history spans over 200 years and today we are a leader in investment banking, consumer and small business banking, commercial banking, financial transaction processing and asset management. We offer a competitive total rewards package including base salary determined based on the role, experience, skill set and location. Those in eligible roles may receive commission-based pay and/or discretionary incentive compensation, paid in the form of cash and/or forfeitable equity, awarded in recognition of individual achievements and contributions. We also offer a range of benefits and programs to meet employee needs, based on eligibility. These benefits include comprehensive health care coverage, on-site health and wellness centers, a retirement savings plan, backup childcare, tuition reimbursement, mental health support, financial coaching and more. Additional details about total compensation and benefits will be provided during the hiring process. We recognize that our people are our strength and the diverse talents they bring to our global workforce are directly linked to our success. We are an equal opportunity employer and place a high value on diversity and inclusion at our company. We do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. We also make reasonable accommodations for applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs. Visit our FAQs for more information about requesting an accommodation. JPMorgan Chase & Co. is an Equal Opportunity Employer, including Disability/Veterans ABOUT THE TEAM . click apply for full job details
Job Description Senior Security Engineer Overview The Senior Security Engineer will lead cybersecurity initiatives in a dynamic financial services environment, ensuring robust security controls and compliance with industry standards. Collaborate with cross-functional teams to strengthen security posture and support regulatory and audit requirements. Design and implement enterprise security solutions across cloud, network, endpoint, and identity domains. Contribute to strategic security initiatives, enhancing operational effectiveness and protecting organizational assets. Utilize expertise in ISO 27001, NIST CSF, and CIS Controls to align security frameworks. Work within a hybrid environment, offering flexibility and opportunities for professional growth. Provide technical leadership in incident response, vulnerability management, and threat detection engineering. Develop and maintain security standards, procedures, and governance materials to ensure compliance. Evaluate emerging cybersecurity technologies to recommend improvements and strengthen security maturity. Senior Security Engineer Key Responsibilities & Duties Design, implement, and maintain enterprise security controls across various domains, including cloud and network security. Lead security engineering initiatives, ensuring secure design recommendations and operational support of security technologies. Manage identity security controls, including multi-factor authentication and privileged access management. Optimize security tools and platforms, including SIEM, DLP, and endpoint protection solutions. Conduct vulnerability assessments, remediation planning, and risk prioritization. Support incident response activities, including threat hunting and forensic analysis. Develop and maintain security procedures, technical baselines, and implementation guidance. Perform risk assessments and recommend mitigation strategies for systems and applications. Collaborate with IT and business teams to integrate security requirements into operational processes. Senior Security Engineer Job Requirements Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field. 5+ years of cybersecurity experience, including security engineering and architecture. Experience with enterprise security technologies across cloud, network, endpoint, and identity domains. Strong knowledge of security tools, including SIEM, EDR/EPS, and vulnerability scanners. Proficiency in securing cloud environments, preferably Microsoft Azure and Microsoft 365. Understanding of networking protocols, firewalls, and IDS/IPS technologies. Experience supporting security programs within regulated industries such as financial services. Preferred certifications include CISSP, CCSP, or CISM. Strong analytical and communication skills, with the ability to influence security outcomes.
11/08/2026
Full time
Job Description Senior Security Engineer Overview The Senior Security Engineer will lead cybersecurity initiatives in a dynamic financial services environment, ensuring robust security controls and compliance with industry standards. Collaborate with cross-functional teams to strengthen security posture and support regulatory and audit requirements. Design and implement enterprise security solutions across cloud, network, endpoint, and identity domains. Contribute to strategic security initiatives, enhancing operational effectiveness and protecting organizational assets. Utilize expertise in ISO 27001, NIST CSF, and CIS Controls to align security frameworks. Work within a hybrid environment, offering flexibility and opportunities for professional growth. Provide technical leadership in incident response, vulnerability management, and threat detection engineering. Develop and maintain security standards, procedures, and governance materials to ensure compliance. Evaluate emerging cybersecurity technologies to recommend improvements and strengthen security maturity. Senior Security Engineer Key Responsibilities & Duties Design, implement, and maintain enterprise security controls across various domains, including cloud and network security. Lead security engineering initiatives, ensuring secure design recommendations and operational support of security technologies. Manage identity security controls, including multi-factor authentication and privileged access management. Optimize security tools and platforms, including SIEM, DLP, and endpoint protection solutions. Conduct vulnerability assessments, remediation planning, and risk prioritization. Support incident response activities, including threat hunting and forensic analysis. Develop and maintain security procedures, technical baselines, and implementation guidance. Perform risk assessments and recommend mitigation strategies for systems and applications. Collaborate with IT and business teams to integrate security requirements into operational processes. Senior Security Engineer Job Requirements Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field. 5+ years of cybersecurity experience, including security engineering and architecture. Experience with enterprise security technologies across cloud, network, endpoint, and identity domains. Strong knowledge of security tools, including SIEM, EDR/EPS, and vulnerability scanners. Proficiency in securing cloud environments, preferably Microsoft Azure and Microsoft 365. Understanding of networking protocols, firewalls, and IDS/IPS technologies. Experience supporting security programs within regulated industries such as financial services. Preferred certifications include CISSP, CCSP, or CISM. Strong analytical and communication skills, with the ability to influence security outcomes.
Job Description As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn't changed - we're here to stop breaches, and we've redefined modern security with the world's most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We're always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you. About the Role: CrowdStrike is seeking an Engineering Manager to join our Proactive Security team within Cloud Security Group. This role will lead our Proactive Protection team, focusing on helping our customers to detect and prevent threats in cloud environments through advanced detection techniques and methodologies, before they can cause harm. You will collaborate closely with cross-functional teams, product management, and security researchers to drive detection capabilities while building a team and managing direct reports. We're seeking innovative problem-solvers who can take ownership of complex technical challenges across our platform. This is an opportunity to work at unprecedented scale with cutting-edge cloud technologies while making a direct impact on organizations worldwide protecting them from sophisticated threats. This role is hybrid, on-site at one of the posted locations. Candidates should be comfortable visiting the office twice a week once the development center is established. About the Cloud Proactive Security Team: A global team of engineers that develops and maintains mechanisms to prevent cloud misconfigurations and security risks before deployment - The team builds intelligent prevention capabilities that identify and block insecure cloud configurations. Develops and maintains proactive security controls that protect Kubernetes clusters, container registries, serverless functions, and cloud workloads from emerging threats in multiple cloud vendors as well as private data centers. Creates developer-friendly tools and integrations that embed security prevention directly into CI/CD pipelines, GitOps workflows, and Kubernetes deployment processes. What You Will Do: Manage a team of engineers building and optimizing the core pipeline that protects cloud workloads, containers, and Kubernetes clusters. As an engineering manager, you will help drive and deliver on both roadmap and technical strategy, and you will be instrumental in hiring, retaining, and growing a team of highly talented engineers. Help to architect enterprise grade solutions that scale seamlessly from thousands to millions of requests per second Build and Lead a Global Team. Manage a distributed team of high-talented cloud specialized software engineers and technical leads, fostering a collaborative environment while coordinating across time zones to deliver high-quality products. Cross-Functional Collaboration. Partner with product management and engineering teams to align cloud proactive capabilities with customer needs, directly influencing CrowdStrike's Proactive detection platform evolution and organizational strategy. Ensure Quality and Accuracy. Own validation processes for proactive vulnerability detections, implementing automated workflows that maintain CrowdStrike's high standards for security solutions. Must be able to work 3+ days per week on site from our New York office. What You'll Need: Must be a U.S. Citizen or US Permanent Resident. BS/MS in Computer Science or related field, or equivalent work experience 7+ years of experience in Software Engineering roles with at least 3+ years in management positions. Security and/or Cloud Security experience is required Understanding of cloud security concepts such as CSPM, CWPP, and CNAPP Exposure to cloud security products, including product direction for AI/ML, XDR, SIEM, SOAR, or related cybersecurity domains. Familiarity with container and Kubernetes security (build-time and runtime) Solid design and problem-solving skills with a demonstrated passion for engineering excellence, quality, security, and performance Broad grounding in all aspects of distributed systems development Experience with Kafka, Cassandra, ElasticSearch technologies Experience building systems at cloud scale and container orchestration technologies such as Kubernetes Proficiency with at least one major cloud platform (AWS, Azure, or GCP) Experience with modern programming languages such as Go, Python, Java, C++, Rust or similar languages Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes. Exceptional communication skills, with the ability to convey complex technical concepts clearly to both executive and engineering audiences, in writing and verbally Strong cross-functional collaboration skills, with a proven ability to partner effectively across engineering, product management, support, and sales engineering Demonstrated success recruiting and hiring strong engineering talent Proven track record of mentoring and developing engineers, helping them grow in their careers and technical skills Bonus Points: Remote/distributed multi-team leadership experience Experience with organizational scaling and process optimization This role will require the candidate to periodically undergo and pass additional background and fingerprint check(s) consistent with government customer requirements. Benefits of Working at CrowdStrike: Market leader in compensation and equity awards Comprehensive physical and mental wellness programs Competitive vacation and holidays for recharge Paid parental and adoption leaves Professional development opportunities for all employees regardless of level or role Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections Vibrant office culture with world class amenities Great Place to Work Certified across the globe CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed. We support veterans and individuals with disabilities through our affirmative action program. CrowdStrike is committed to providing equal employment opportunity for all employees and applicants for employment. The Company does not discriminate in employment opportunities or practices on the basis of race, color, creed, ethnicity, religion, sex (including pregnancy or pregnancy-related medical conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical disability (including HIV and AIDS), mental disability, medical condition, genetic information, membership or activity in a local human rights commission, status with regard to public assistance, or any other characteristic protected by law. We base all employment decisions including recruitment, selection, training, compensation, benefits, discipline, promotions, transfers, lay-offs, return from lay-off, terminations and social/recreational programs on valid job requirements. If you need assistance accessing or reviewing the information on this website or need help submitting an application for employment or requesting an accommodation, please contact us at for further assistance. Find out more about your rights as an applicant. CrowdStrike participates in the E-Verify program. Notice of E-Verify Participation Right to Work CrowdStrike, Inc. is committed to fair and equitable compensation practices. Placement within the pay range is dependent on a variety of factors including, but not limited to, relevant work experience, skills, certifications, job level, supervisory status, and location. The base salary range for this position for all U.S. candidates is $140,000 - $215,000 per year, with eligibility for bonuses, equity grants and a comprehensive benefits package that includes health insurance, 401k and paid time off. For detailed information about the U.S. benefits package, please click here.
11/07/2026
Full time
Job Description As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn't changed - we're here to stop breaches, and we've redefined modern security with the world's most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We're always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you. About the Role: CrowdStrike is seeking an Engineering Manager to join our Proactive Security team within Cloud Security Group. This role will lead our Proactive Protection team, focusing on helping our customers to detect and prevent threats in cloud environments through advanced detection techniques and methodologies, before they can cause harm. You will collaborate closely with cross-functional teams, product management, and security researchers to drive detection capabilities while building a team and managing direct reports. We're seeking innovative problem-solvers who can take ownership of complex technical challenges across our platform. This is an opportunity to work at unprecedented scale with cutting-edge cloud technologies while making a direct impact on organizations worldwide protecting them from sophisticated threats. This role is hybrid, on-site at one of the posted locations. Candidates should be comfortable visiting the office twice a week once the development center is established. About the Cloud Proactive Security Team: A global team of engineers that develops and maintains mechanisms to prevent cloud misconfigurations and security risks before deployment - The team builds intelligent prevention capabilities that identify and block insecure cloud configurations. Develops and maintains proactive security controls that protect Kubernetes clusters, container registries, serverless functions, and cloud workloads from emerging threats in multiple cloud vendors as well as private data centers. Creates developer-friendly tools and integrations that embed security prevention directly into CI/CD pipelines, GitOps workflows, and Kubernetes deployment processes. What You Will Do: Manage a team of engineers building and optimizing the core pipeline that protects cloud workloads, containers, and Kubernetes clusters. As an engineering manager, you will help drive and deliver on both roadmap and technical strategy, and you will be instrumental in hiring, retaining, and growing a team of highly talented engineers. Help to architect enterprise grade solutions that scale seamlessly from thousands to millions of requests per second Build and Lead a Global Team. Manage a distributed team of high-talented cloud specialized software engineers and technical leads, fostering a collaborative environment while coordinating across time zones to deliver high-quality products. Cross-Functional Collaboration. Partner with product management and engineering teams to align cloud proactive capabilities with customer needs, directly influencing CrowdStrike's Proactive detection platform evolution and organizational strategy. Ensure Quality and Accuracy. Own validation processes for proactive vulnerability detections, implementing automated workflows that maintain CrowdStrike's high standards for security solutions. Must be able to work 3+ days per week on site from our New York office. What You'll Need: Must be a U.S. Citizen or US Permanent Resident. BS/MS in Computer Science or related field, or equivalent work experience 7+ years of experience in Software Engineering roles with at least 3+ years in management positions. Security and/or Cloud Security experience is required Understanding of cloud security concepts such as CSPM, CWPP, and CNAPP Exposure to cloud security products, including product direction for AI/ML, XDR, SIEM, SOAR, or related cybersecurity domains. Familiarity with container and Kubernetes security (build-time and runtime) Solid design and problem-solving skills with a demonstrated passion for engineering excellence, quality, security, and performance Broad grounding in all aspects of distributed systems development Experience with Kafka, Cassandra, ElasticSearch technologies Experience building systems at cloud scale and container orchestration technologies such as Kubernetes Proficiency with at least one major cloud platform (AWS, Azure, or GCP) Experience with modern programming languages such as Go, Python, Java, C++, Rust or similar languages Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes. Exceptional communication skills, with the ability to convey complex technical concepts clearly to both executive and engineering audiences, in writing and verbally Strong cross-functional collaboration skills, with a proven ability to partner effectively across engineering, product management, support, and sales engineering Demonstrated success recruiting and hiring strong engineering talent Proven track record of mentoring and developing engineers, helping them grow in their careers and technical skills Bonus Points: Remote/distributed multi-team leadership experience Experience with organizational scaling and process optimization This role will require the candidate to periodically undergo and pass additional background and fingerprint check(s) consistent with government customer requirements. Benefits of Working at CrowdStrike: Market leader in compensation and equity awards Comprehensive physical and mental wellness programs Competitive vacation and holidays for recharge Paid parental and adoption leaves Professional development opportunities for all employees regardless of level or role Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections Vibrant office culture with world class amenities Great Place to Work Certified across the globe CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed. We support veterans and individuals with disabilities through our affirmative action program. CrowdStrike is committed to providing equal employment opportunity for all employees and applicants for employment. The Company does not discriminate in employment opportunities or practices on the basis of race, color, creed, ethnicity, religion, sex (including pregnancy or pregnancy-related medical conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical disability (including HIV and AIDS), mental disability, medical condition, genetic information, membership or activity in a local human rights commission, status with regard to public assistance, or any other characteristic protected by law. We base all employment decisions including recruitment, selection, training, compensation, benefits, discipline, promotions, transfers, lay-offs, return from lay-off, terminations and social/recreational programs on valid job requirements. If you need assistance accessing or reviewing the information on this website or need help submitting an application for employment or requesting an accommodation, please contact us at for further assistance. Find out more about your rights as an applicant. CrowdStrike participates in the E-Verify program. Notice of E-Verify Participation Right to Work CrowdStrike, Inc. is committed to fair and equitable compensation practices. Placement within the pay range is dependent on a variety of factors including, but not limited to, relevant work experience, skills, certifications, job level, supervisory status, and location. The base salary range for this position for all U.S. candidates is $140,000 - $215,000 per year, with eligibility for bonuses, equity grants and a comprehensive benefits package that includes health insurance, 401k and paid time off. For detailed information about the U.S. benefits package, please click here.
Job Description As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn't changed - we're here to stop breaches, and we've redefined modern security with the world's most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We're always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you. About The Role: CrowdStrike Falcon is a two-component security product. One component is the "Sensor" - a lightweight agent installed on endpoint systems that observes system activity, recognizes malicious behavior, provides on-box prevention capability, and sends telemetry to the Falcon cloud. The cloud component aggregates Sensor telemetry across each customer's network, correlates malicious behavior across machines, and presents security teams with a prioritized summary of the threats detected in their environments. The Falcon Sensor runs on tens of millions of endpoints worldwide, across Windows, macOS and Linux, in both user mode and kernel mode. Engineering software at that depth and that scale is among the hardest problems in the industry, and CrowdStrike holds the Sensor to an exceptionally high standard of quality, performance and engineering rigor. Sustaining that standard requires a team with true mastery of what software does at runtime, at the lowest levels of the stack. That team is Sensor Performance and Reliability - CrowdStrike's team of debug engineers. Deep runtime analysis is our craft: postmortem memory dump analysis, disassembly and reverse engineering, and source-level analysis, used to explain with precision and evidence how low-level code behaves on real systems. It is one of the most technically demanding specialties in systems engineering, and very few organizations invest in it as a discipline in its own right. We do, because at our scale the answer to "what exactly happened, and why?" has to be exact rather than approximate. Our mandate goes further than answering that question well. We're chartered to turn what we learn from deep analysis into durable engineering improvements - strengthening diagnostics, tooling, validation coverage and development practices so that lessons generalize far beyond the investigation that produced them, and so that the next analysis is faster than the last. Our work makes the product stronger, and it raises the engineering capability of every team we work with. We are hiring an entry-level engineer to join us in that mission. We do not expect you to arrive with deep Windows internals, assembly, or reverse engineering experience. Those are skills we will teach you, and you will learn them from engineers who operate at the top of this field. What we are looking for is a strong programmer with excellent problem-solving instincts and genuine curiosity about how computers actually work underneath the abstractions - someone who is drawn to a hard, ambiguous problem rather than put off by it. If you are the kind of person who cannot leave a mystery alone until you understand it completely, this is an unusually good place to build a career. Location: This is a hybrid role based out of one of the posted locations: Redmond, WA or Sunnyvale, CA, with a combination of in-office and remote work. What You'll Do: Analyze the runtime behavior of complex low-level software across user mode and kernel mode on Windows, primarily through postmortem memory dump analysis in WinDbg. Work from raw memory, register state and disassembly to a precise, evidence-backed account of what executing code did and why - and hold yourself to a high evidentiary bar in reaching it. Correlate your analysis with source code, applying reverse engineering and disassembly techniques where symbols, source or context are incomplete. Drive investigations to accurate, well-reasoned conclusions rather than plausible-sounding ones, and communicate confidence and uncertainty honestly. Partner with Sensor development teams to translate your findings into concrete, well-designed engineering improvements. Generalize from individual investigations: recognize patterns, and champion improvements to tooling, diagnostics, automated validation and engineering practice that raise the reliability bar broadly rather than locally. Build and improve the tooling, automation and analysis techniques that make deep runtime analysis faster, more repeatable and more accessible - for our team and for Sensor engineers across the company. Write clearly and precisely for engineering, quality and leadership audiences. A first-rate technical analysis is only as valuable as its reader's ability to act on it. Collaborate with engineering teams across multiple locations and timezones, including Sensor platform, detection and OS-specialist teams. What You'll Need: BS in Computer Science, Computer Engineering, or equivalent practical experience. Solid working knowledge of C and C++, and the ability to read and reason about code you did not write. Good foundational knowledge of data structures and algorithms. Strong problem-solving and analytical skills, and comfort working with incomplete information - much of this work involves reconstructing runtime behavior from partial evidence. Genuine curiosity about systems fundamentals: operating system internals, computer architecture, memory management, concurrency, compilers and assembly. You should want to learn these deeply. Persistence and intellectual honesty: the willingness to keep digging until you actually know the answer, and to say clearly when you don't yet. Good written and verbal communication skills. Ability to take ownership of your work and follow it through to resolution. Ability to communicate, collaborate, and work effectively in a globally distributed team. Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes. Bonus Points: Any exposure to debugging tools and techniques - WinDbg, GDB, LLDB, or similar - including as a hobby, in coursework, or in CTFs. Coursework, internships, or personal projects involving operating system internals, kernel or driver development, systems programming, or computer architecture. Familiarity with x86-64 or ARM64 assembly and the ability to read disassembly. Exposure to reverse engineering, malware analysis, or vulnerability research. Experience with Windows internals specifically (processes, threads, virtual memory, synchronization, the Windows kernel and driver model). Scripting experience, particularly Python, for automation and analysis tooling. Interest in or experience with the security landscape. Benefits of Working at CrowdStrike: Market leader in compensation and equity awards Comprehensive physical and mental wellness programs Competitive vacation and holidays for recharge Paid parental and adoption leaves Professional development opportunities for all employees regardless of level or role Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections Vibrant office culture with world class amenities Great Place to Work Certified across the globe CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed. We support veterans and individuals with disabilities through our affirmative action program. CrowdStrike is committed to providing equal employment opportunity for all employees and applicants for employment. The Company does not discriminate in employment opportunities or practices on the basis of race, color, creed, ethnicity, religion, sex (including pregnancy or pregnancy-related medical conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical disability (including HIV and AIDS), mental disability, medical condition, genetic information, membership or activity in a local human rights commission, status with regard to public assistance, or any other characteristic protected by law. We base all employment decisions including recruitment, selection, training, compensation, benefits, discipline, promotions, transfers, lay-offs, return from lay-off, terminations and social/recreational programs on valid job requirements. . click apply for full job details
11/07/2026
Full time
Job Description As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn't changed - we're here to stop breaches, and we've redefined modern security with the world's most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We're always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you. About The Role: CrowdStrike Falcon is a two-component security product. One component is the "Sensor" - a lightweight agent installed on endpoint systems that observes system activity, recognizes malicious behavior, provides on-box prevention capability, and sends telemetry to the Falcon cloud. The cloud component aggregates Sensor telemetry across each customer's network, correlates malicious behavior across machines, and presents security teams with a prioritized summary of the threats detected in their environments. The Falcon Sensor runs on tens of millions of endpoints worldwide, across Windows, macOS and Linux, in both user mode and kernel mode. Engineering software at that depth and that scale is among the hardest problems in the industry, and CrowdStrike holds the Sensor to an exceptionally high standard of quality, performance and engineering rigor. Sustaining that standard requires a team with true mastery of what software does at runtime, at the lowest levels of the stack. That team is Sensor Performance and Reliability - CrowdStrike's team of debug engineers. Deep runtime analysis is our craft: postmortem memory dump analysis, disassembly and reverse engineering, and source-level analysis, used to explain with precision and evidence how low-level code behaves on real systems. It is one of the most technically demanding specialties in systems engineering, and very few organizations invest in it as a discipline in its own right. We do, because at our scale the answer to "what exactly happened, and why?" has to be exact rather than approximate. Our mandate goes further than answering that question well. We're chartered to turn what we learn from deep analysis into durable engineering improvements - strengthening diagnostics, tooling, validation coverage and development practices so that lessons generalize far beyond the investigation that produced them, and so that the next analysis is faster than the last. Our work makes the product stronger, and it raises the engineering capability of every team we work with. We are hiring an entry-level engineer to join us in that mission. We do not expect you to arrive with deep Windows internals, assembly, or reverse engineering experience. Those are skills we will teach you, and you will learn them from engineers who operate at the top of this field. What we are looking for is a strong programmer with excellent problem-solving instincts and genuine curiosity about how computers actually work underneath the abstractions - someone who is drawn to a hard, ambiguous problem rather than put off by it. If you are the kind of person who cannot leave a mystery alone until you understand it completely, this is an unusually good place to build a career. Location: This is a hybrid role based out of one of the posted locations: Redmond, WA or Sunnyvale, CA, with a combination of in-office and remote work. What You'll Do: Analyze the runtime behavior of complex low-level software across user mode and kernel mode on Windows, primarily through postmortem memory dump analysis in WinDbg. Work from raw memory, register state and disassembly to a precise, evidence-backed account of what executing code did and why - and hold yourself to a high evidentiary bar in reaching it. Correlate your analysis with source code, applying reverse engineering and disassembly techniques where symbols, source or context are incomplete. Drive investigations to accurate, well-reasoned conclusions rather than plausible-sounding ones, and communicate confidence and uncertainty honestly. Partner with Sensor development teams to translate your findings into concrete, well-designed engineering improvements. Generalize from individual investigations: recognize patterns, and champion improvements to tooling, diagnostics, automated validation and engineering practice that raise the reliability bar broadly rather than locally. Build and improve the tooling, automation and analysis techniques that make deep runtime analysis faster, more repeatable and more accessible - for our team and for Sensor engineers across the company. Write clearly and precisely for engineering, quality and leadership audiences. A first-rate technical analysis is only as valuable as its reader's ability to act on it. Collaborate with engineering teams across multiple locations and timezones, including Sensor platform, detection and OS-specialist teams. What You'll Need: BS in Computer Science, Computer Engineering, or equivalent practical experience. Solid working knowledge of C and C++, and the ability to read and reason about code you did not write. Good foundational knowledge of data structures and algorithms. Strong problem-solving and analytical skills, and comfort working with incomplete information - much of this work involves reconstructing runtime behavior from partial evidence. Genuine curiosity about systems fundamentals: operating system internals, computer architecture, memory management, concurrency, compilers and assembly. You should want to learn these deeply. Persistence and intellectual honesty: the willingness to keep digging until you actually know the answer, and to say clearly when you don't yet. Good written and verbal communication skills. Ability to take ownership of your work and follow it through to resolution. Ability to communicate, collaborate, and work effectively in a globally distributed team. Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes. Bonus Points: Any exposure to debugging tools and techniques - WinDbg, GDB, LLDB, or similar - including as a hobby, in coursework, or in CTFs. Coursework, internships, or personal projects involving operating system internals, kernel or driver development, systems programming, or computer architecture. Familiarity with x86-64 or ARM64 assembly and the ability to read disassembly. Exposure to reverse engineering, malware analysis, or vulnerability research. Experience with Windows internals specifically (processes, threads, virtual memory, synchronization, the Windows kernel and driver model). Scripting experience, particularly Python, for automation and analysis tooling. Interest in or experience with the security landscape. Benefits of Working at CrowdStrike: Market leader in compensation and equity awards Comprehensive physical and mental wellness programs Competitive vacation and holidays for recharge Paid parental and adoption leaves Professional development opportunities for all employees regardless of level or role Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections Vibrant office culture with world class amenities Great Place to Work Certified across the globe CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed. We support veterans and individuals with disabilities through our affirmative action program. CrowdStrike is committed to providing equal employment opportunity for all employees and applicants for employment. The Company does not discriminate in employment opportunities or practices on the basis of race, color, creed, ethnicity, religion, sex (including pregnancy or pregnancy-related medical conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical disability (including HIV and AIDS), mental disability, medical condition, genetic information, membership or activity in a local human rights commission, status with regard to public assistance, or any other characteristic protected by law. We base all employment decisions including recruitment, selection, training, compensation, benefits, discipline, promotions, transfers, lay-offs, return from lay-off, terminations and social/recreational programs on valid job requirements. . click apply for full job details
Job Description As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn't changed - we're here to stop breaches, and we've redefined modern security with the world's most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We're always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you. About the Role: Falcon Vulnerability Assessment is the industry's first scan-less endpoint vulnerability assessment solution, delivering real-time, zero-impact assessments of endpoint security posture. Falcon Vulnerabiity Assessment adds preparation and readiness to the unparalleled prevention, detection and response provided by the Falcon platform, resulting in a stronger security posture and unprecedented breach protection. As part of CrowdStrike's cutting-edge Falcon Exposure Management pillar, you'll be at the forefront of cybersecurity innovation, elevating our industry-leading "stopping breaches" mission to unprecedented levels of sophistication and visibility. You'll architect and build the foundational risk intelligence platform that powers next-generation security insights, leveraging advanced algorithms, AI, and machine learning to deliver comprehensive visibility into risk compounding, attack path analysis, and posture scoring across hybrid environments-spanning hosts, cloud infrastructure, and identity assets. The core focus of this specific role is developing robust backend services that seamlessly ingest massive data streams, execute complex risk calculations, and deliver intelligent remediation automation. Working primarily with Golang microservices architecture and multiple database ecosystems, you'll build scalable solutions that protect organizations worldwide from evolving cyber threats. As a technical leader, you'll drive end-to-end product delivery, architect scalable solutions, and collaborate with cross-functional stakeholders to define priorities and scope. Your expertise will directly influence the cybersecurity landscape, protecting organizations from sophisticated threats while advancing the state of the art in exposure management This role also requires reasoning and judgment over large volumes of continuously changing data, at the scale CrowdStrike operates - work that conventional rule-based systems have only partially addressed. We're treating agentic reasoning as a core architectural element rather than a feature layered onto an existing system, which means real decisions are still open: where reasoning belongs, where determinism is the better answer, and how to make either hold up in production. This role is hybrid and attached to our Sunnyvale, CA office, requiring 2-3 days in office. What You'll Do: Design and build high-throughput, low-latency backend services and APIs in Golang and Python Architect and operate cloud-native infrastructure across AWS and GCP at scale (S3, SQS, Kubernetes/KEDA, and more) Build and maintain Kafka-based event streaming pipelines for near-real-time vulnerability event processing Drive backend engineering and process automation across the platform Partner with security researchers and platform teams (Intel, EPP) to deliver integrated capabilities Own service reliability - performance profiling, incident response, and root cause analysis on time-sensitive production issues Continuously re-engineer for improved architecture, performance, and stability Write high-quality, well-tested, production-ready code with a focus on observability and operability Build agentic capabilities into the product - systems that reason over real data, use tools, and produce explainable results customers can act on Take AI capabilities from prototype to production, owning latency, cost, correctness, and evaluation Design the guardrails and policies that make autonomous reasoning safe for enterprise customers What You'll Need: 10-15 years of backend engineering experience. Solid experience with Golang/Java in production systems. Strong understanding of distributed systems, microservices, and event-driven architectures. Hands-on experience with AWS cloud services (S3, SQS, and similar) Experience with Kafka or other event streaming platforms. Strong database skills - Cassandra, Elasticsearch/OpenSearch, Redis, or similar distributed data stores. Hands-on use of frontier-model SDKs (Anthropic, OpenAI, or similar) and AI-assisted development tools, with a realistic view of their capabilities and limits. Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes. Ability to communicate effectively at all levels of an organization Strong collaboration skills and experience working in a global team Commitment to software quality - unit tested, code reviewed, and continuously integrated Bonus Points: Experience in cybersecurity - welcome, though not required Experience with Kubernetes and event-driven autoscaling (KEDA) Experience with observability tooling (Splunk, Grafana, LogScale, or similar) Familiarity with security vulnerability management or cybersecurity platforms Good understanding of Windows OS internals and the Windows API Experience with infrastructure-as-code (Terraform, CDK, or similar) Prior experience with large-scale data acquisition or content pipeline systems Experience with evaluation and observability tooling for agentic systems Experience with RAG pipelines, vector stores, or retrieval-augmented agents Experience with graph databases and complex data modeling Benefits of Working at CrowdStrike: Market leader in compensation and equity awards Comprehensive physical and mental wellness programs Competitive vacation and holidays for recharge Paid parental and adoption leaves Professional development opportunities for all employees regardless of level or role Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections Vibrant office culture with world class amenities Great Place to Work Certified across the globe CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed. We support veterans and individuals with disabilities through our affirmative action program. CrowdStrike is committed to providing equal employment opportunity for all employees and applicants for employment. The Company does not discriminate in employment opportunities or practices on the basis of race, color, creed, ethnicity, religion, sex (including pregnancy or pregnancy-related medical conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical disability (including HIV and AIDS), mental disability, medical condition, genetic information, membership or activity in a local human rights commission, status with regard to public assistance, or any other characteristic protected by law. We base all employment decisions including recruitment, selection, training, compensation, benefits, discipline, promotions, transfers, lay-offs, return from lay-off, terminations and social/recreational programs on valid job requirements. If you need assistance accessing or reviewing the information on this website or need help submitting an application for employment or requesting an accommodation, please contact us at for further assistance. Find out more about your rights as an applicant. CrowdStrike participates in the E-Verify program. Notice of E-Verify Participation Right to Work CrowdStrike, Inc. is committed to fair and equitable compensation practices. Placement within the pay range is dependent on a variety of factors including, but not limited to, relevant work experience, skills, certifications, job level, supervisory status, and location. The base salary range for this position for all U.S. candidates is $140,000 - $215,000 per year, with eligibility for bonuses, equity grants and a comprehensive benefits package that includes health insurance, 401k and paid time off. For detailed information about the U.S. benefits package, please click here.
11/07/2026
Full time
Job Description As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn't changed - we're here to stop breaches, and we've redefined modern security with the world's most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We're always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you. About the Role: Falcon Vulnerability Assessment is the industry's first scan-less endpoint vulnerability assessment solution, delivering real-time, zero-impact assessments of endpoint security posture. Falcon Vulnerabiity Assessment adds preparation and readiness to the unparalleled prevention, detection and response provided by the Falcon platform, resulting in a stronger security posture and unprecedented breach protection. As part of CrowdStrike's cutting-edge Falcon Exposure Management pillar, you'll be at the forefront of cybersecurity innovation, elevating our industry-leading "stopping breaches" mission to unprecedented levels of sophistication and visibility. You'll architect and build the foundational risk intelligence platform that powers next-generation security insights, leveraging advanced algorithms, AI, and machine learning to deliver comprehensive visibility into risk compounding, attack path analysis, and posture scoring across hybrid environments-spanning hosts, cloud infrastructure, and identity assets. The core focus of this specific role is developing robust backend services that seamlessly ingest massive data streams, execute complex risk calculations, and deliver intelligent remediation automation. Working primarily with Golang microservices architecture and multiple database ecosystems, you'll build scalable solutions that protect organizations worldwide from evolving cyber threats. As a technical leader, you'll drive end-to-end product delivery, architect scalable solutions, and collaborate with cross-functional stakeholders to define priorities and scope. Your expertise will directly influence the cybersecurity landscape, protecting organizations from sophisticated threats while advancing the state of the art in exposure management This role also requires reasoning and judgment over large volumes of continuously changing data, at the scale CrowdStrike operates - work that conventional rule-based systems have only partially addressed. We're treating agentic reasoning as a core architectural element rather than a feature layered onto an existing system, which means real decisions are still open: where reasoning belongs, where determinism is the better answer, and how to make either hold up in production. This role is hybrid and attached to our Sunnyvale, CA office, requiring 2-3 days in office. What You'll Do: Design and build high-throughput, low-latency backend services and APIs in Golang and Python Architect and operate cloud-native infrastructure across AWS and GCP at scale (S3, SQS, Kubernetes/KEDA, and more) Build and maintain Kafka-based event streaming pipelines for near-real-time vulnerability event processing Drive backend engineering and process automation across the platform Partner with security researchers and platform teams (Intel, EPP) to deliver integrated capabilities Own service reliability - performance profiling, incident response, and root cause analysis on time-sensitive production issues Continuously re-engineer for improved architecture, performance, and stability Write high-quality, well-tested, production-ready code with a focus on observability and operability Build agentic capabilities into the product - systems that reason over real data, use tools, and produce explainable results customers can act on Take AI capabilities from prototype to production, owning latency, cost, correctness, and evaluation Design the guardrails and policies that make autonomous reasoning safe for enterprise customers What You'll Need: 10-15 years of backend engineering experience. Solid experience with Golang/Java in production systems. Strong understanding of distributed systems, microservices, and event-driven architectures. Hands-on experience with AWS cloud services (S3, SQS, and similar) Experience with Kafka or other event streaming platforms. Strong database skills - Cassandra, Elasticsearch/OpenSearch, Redis, or similar distributed data stores. Hands-on use of frontier-model SDKs (Anthropic, OpenAI, or similar) and AI-assisted development tools, with a realistic view of their capabilities and limits. Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes. Ability to communicate effectively at all levels of an organization Strong collaboration skills and experience working in a global team Commitment to software quality - unit tested, code reviewed, and continuously integrated Bonus Points: Experience in cybersecurity - welcome, though not required Experience with Kubernetes and event-driven autoscaling (KEDA) Experience with observability tooling (Splunk, Grafana, LogScale, or similar) Familiarity with security vulnerability management or cybersecurity platforms Good understanding of Windows OS internals and the Windows API Experience with infrastructure-as-code (Terraform, CDK, or similar) Prior experience with large-scale data acquisition or content pipeline systems Experience with evaluation and observability tooling for agentic systems Experience with RAG pipelines, vector stores, or retrieval-augmented agents Experience with graph databases and complex data modeling Benefits of Working at CrowdStrike: Market leader in compensation and equity awards Comprehensive physical and mental wellness programs Competitive vacation and holidays for recharge Paid parental and adoption leaves Professional development opportunities for all employees regardless of level or role Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections Vibrant office culture with world class amenities Great Place to Work Certified across the globe CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed. We support veterans and individuals with disabilities through our affirmative action program. CrowdStrike is committed to providing equal employment opportunity for all employees and applicants for employment. The Company does not discriminate in employment opportunities or practices on the basis of race, color, creed, ethnicity, religion, sex (including pregnancy or pregnancy-related medical conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical disability (including HIV and AIDS), mental disability, medical condition, genetic information, membership or activity in a local human rights commission, status with regard to public assistance, or any other characteristic protected by law. We base all employment decisions including recruitment, selection, training, compensation, benefits, discipline, promotions, transfers, lay-offs, return from lay-off, terminations and social/recreational programs on valid job requirements. If you need assistance accessing or reviewing the information on this website or need help submitting an application for employment or requesting an accommodation, please contact us at for further assistance. Find out more about your rights as an applicant. CrowdStrike participates in the E-Verify program. Notice of E-Verify Participation Right to Work CrowdStrike, Inc. is committed to fair and equitable compensation practices. Placement within the pay range is dependent on a variety of factors including, but not limited to, relevant work experience, skills, certifications, job level, supervisory status, and location. The base salary range for this position for all U.S. candidates is $140,000 - $215,000 per year, with eligibility for bonuses, equity grants and a comprehensive benefits package that includes health insurance, 401k and paid time off. For detailed information about the U.S. benefits package, please click here.
Job Description Job Description ABOUT LVT LVT is redefining how businesses operate in the physical world, moving beyond traditional security solutions to deliver AI-driven, actionable intelligence that makes sites smarter, safer, and more secure. Since pioneering our first mobile, solar-powered units, our commitment to scrappy, hands-on innovation has made us an established leader and one of the fastest-growing companies in intelligent site technology. We are building the next generation of solutions-from our physical units in the field to a powerful Agentic AI platform-that allows our customers to gain unprecedented visibility and control over safety, compliance, and operations. This is your chance to join a cutting-edge team that isn't just watching the world change, but actively building the technology that is changing it. We're a team that's focused on growth and innovation, and we're proud that our crew, products, and leadership are being recognized for it. A Top-Tier Growth Company: Named one of the Financial Times' Fastest Growing Companies 2025 and on the Inc. 5000 Rocky Mountain Regional list for 2025. Innovative Leadership: Our CEO, Ryan Porter, was named an EY Entrepreneur of the Year 2025 , and our CTO, Steve Lindsey, was inducted into the Silicon Slopes CTO Hall of Fame in 2024. Product & Software Excellence: We were named one of The Software Report's Top 100 Software Companies of 2023 and are a winner of the Security Today Govies Award for 2025. ABOUT THIS ROLE At LVT, application security isn't an internal formality or a late-stage gate. We run a multi-tenant cloud platform, AI-driven video analytics, and license plate recognition pipelines, and we deploy thousands of solar-powered units everywhere from remote utility sites to busy retail parking lots, where anyone can walk up and touch the hardware. A tenant isolation bug, an unsigned firmware update, or a flaw in our analytics isn't just a ticket. It's a customer incident, a potential public headline, and a threat to public trust. We don't block innovation; we make high-speed execution safe. We are seeking a Senior Manager, Application Security to own product security end-to-end across LVT's physical and digital architecture. This is a player-coach role: you will manage and mentor our existing application security engineers, hire 1-2 additional security engineers, and launch a Security Champions program across product teams. Reporting to our Director, Security Engineering, you will earn a standing seat in product and engineering planning, frame risk so clearly that engineering leaders take ownership of it, and design guardrails that make the secure path the easiest path. If you'd rather build the program than police it, this role offers direct organizational impact. This role is based full-time in-office out of our Headquarters in American Fork, Utah. ROLE RESPONSIBILITIES Team Leadership: Directly manage and mentor current AppSec engineers, hire and onboard 1-2 security engineers, and launch a cross-functional Security Champions program that scales your impact across every engineering squad. Product Security Ownership: Set the architecture and standards for LVT's full attack surface, from our multi-tenant cloud platform and partner APIs to mobile clients, computer vision pipelines, and solar-powered edge firmware. Engineering Partnership: Hold a standing seat in product design and planning, turning security risks into prioritized backlog items that engineering teams own and ship. Threat Modeling at Scale: Make threat modeling a core muscle that engineering squads run independently. Train teams on the fundamentals while staying hands-on for high-stakes system designs and edge/hardware boundaries. Tenant Isolation: Define, enforce, and test tenant boundaries across all platform services, deploying automated checks so cross-tenant data leaks never reach production. Secure SDLC Automation: Build security into CI/CD pipelines as code (SAST, SCA, secrets detection, IaC policy), delivering developer feedback in minutes, not sprints, with low noise and clear build-break rules. Edge & Firmware Security: Partner with hardware and embedded teams on device boot security, signed OTA update pipelines, edge credential management, and threat models that assume physical access. AI/ML & Analytics Security: Safeguard our AI vision models, prompt boundaries, and data pipelines against abuse, keeping privacy-by-design at the forefront in a regulated and publicly scrutinized space. AI-Assisted Development Standards: Define guardrails for how LVT engineers use AI coding agents, ensuring AI-generated code meets our standards for safety, testing, and architecture. Compliance as Engineering Artifacts: Turn real product security controls into audit evidence for SOC 2, GovRAMP, FedRAMP, and CJIS through native engineering workflows instead of manual compliance exercises. Incident Response & Disclosure: Oversee external vulnerability intake, triage, and coordinated disclosure (VDP/bug bounty), and lead engineering response to product security incidents. Observability & Systemic Defenses: Partner with SecOps to instrument telemetry for authorization failures and edge abuse, turning incident learnings into root-cause controls. OUR IDEAL CANDIDATE The Player-Coach Mindset: 10+ years in AppSec or product security, including significant time as a hands-on engineer and 4+ years as a people manager or formal technical lead. You still read code, build automation, and hold your own in architecture reviews with principal engineers. Engineering Empathy: You know what it takes to ship software. You've carried a pager, hit deadlines, or maintained a release pipeline. You understand why shortcuts happen and spend your political capital wisely. Cross-Functional Influencer: You can point to releases or system architectures that changed because of an argument you made, and explain how you earned buy-in without pulling rank. Cloud & SaaS Depth: Deep technical grounding in multi-tenant authorization, zero-trust architectures, and API security at scale. Tooling & Code Fluency: Fluent in at least one language in our stack (e.g., Python, Go, TypeScript/Node, C/C++), with the ability to write custom automation, tooling, and CI integrations. Hardware & Firmware Exposure: Familiarity with IoT, embedded platforms, hardware security modules, or OTA update validation, or a proven ability to master physical attack surfaces quickly. AI/ML Security Literate: Understanding of model supply chain risks, data handling during inference, and security reviews for AI-augmented features. Metrics-Driven: You know the difference between a tool and a program. You measure success by coverage, adoption, defect recurrence, and remediation velocity. Location: Based onsite out of our headquarters in American Fork, Utah. Bonus Points: Experience in video streaming, computer vision, or physical safety products; hands-on work in regulated spaces (FedRAMP, GovRAMP, StateRAMP, CJIS); a track record scaling a formal Security Champions program or running a VDP/bug bounty. BENEFITS We believe you do your best work when your whole life is supported. We invest in our crew's health, families, and financial futures with a benefits package designed to support you inside and outside the office. Full-time benefits include, but not limited to: Comprehensive health, dental and vision coverage, retirement benefits (401k match up to 4%), and flexible PTO. LVT IS PROUD TO BE AN EQUAL OPPORTUNITY EMPLOYER. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status. All candidates must pass a drug screening and background check upon employment. Some roles may also require passing a federal background check and fingerprinting. Must be authorized to work in the U.S. If reasonable accommodation is needed to participate in the job application or interview process, and/or to perform essential job functions, please reach out to your recruiter.
11/06/2026
Full time
Job Description Job Description ABOUT LVT LVT is redefining how businesses operate in the physical world, moving beyond traditional security solutions to deliver AI-driven, actionable intelligence that makes sites smarter, safer, and more secure. Since pioneering our first mobile, solar-powered units, our commitment to scrappy, hands-on innovation has made us an established leader and one of the fastest-growing companies in intelligent site technology. We are building the next generation of solutions-from our physical units in the field to a powerful Agentic AI platform-that allows our customers to gain unprecedented visibility and control over safety, compliance, and operations. This is your chance to join a cutting-edge team that isn't just watching the world change, but actively building the technology that is changing it. We're a team that's focused on growth and innovation, and we're proud that our crew, products, and leadership are being recognized for it. A Top-Tier Growth Company: Named one of the Financial Times' Fastest Growing Companies 2025 and on the Inc. 5000 Rocky Mountain Regional list for 2025. Innovative Leadership: Our CEO, Ryan Porter, was named an EY Entrepreneur of the Year 2025 , and our CTO, Steve Lindsey, was inducted into the Silicon Slopes CTO Hall of Fame in 2024. Product & Software Excellence: We were named one of The Software Report's Top 100 Software Companies of 2023 and are a winner of the Security Today Govies Award for 2025. ABOUT THIS ROLE At LVT, application security isn't an internal formality or a late-stage gate. We run a multi-tenant cloud platform, AI-driven video analytics, and license plate recognition pipelines, and we deploy thousands of solar-powered units everywhere from remote utility sites to busy retail parking lots, where anyone can walk up and touch the hardware. A tenant isolation bug, an unsigned firmware update, or a flaw in our analytics isn't just a ticket. It's a customer incident, a potential public headline, and a threat to public trust. We don't block innovation; we make high-speed execution safe. We are seeking a Senior Manager, Application Security to own product security end-to-end across LVT's physical and digital architecture. This is a player-coach role: you will manage and mentor our existing application security engineers, hire 1-2 additional security engineers, and launch a Security Champions program across product teams. Reporting to our Director, Security Engineering, you will earn a standing seat in product and engineering planning, frame risk so clearly that engineering leaders take ownership of it, and design guardrails that make the secure path the easiest path. If you'd rather build the program than police it, this role offers direct organizational impact. This role is based full-time in-office out of our Headquarters in American Fork, Utah. ROLE RESPONSIBILITIES Team Leadership: Directly manage and mentor current AppSec engineers, hire and onboard 1-2 security engineers, and launch a cross-functional Security Champions program that scales your impact across every engineering squad. Product Security Ownership: Set the architecture and standards for LVT's full attack surface, from our multi-tenant cloud platform and partner APIs to mobile clients, computer vision pipelines, and solar-powered edge firmware. Engineering Partnership: Hold a standing seat in product design and planning, turning security risks into prioritized backlog items that engineering teams own and ship. Threat Modeling at Scale: Make threat modeling a core muscle that engineering squads run independently. Train teams on the fundamentals while staying hands-on for high-stakes system designs and edge/hardware boundaries. Tenant Isolation: Define, enforce, and test tenant boundaries across all platform services, deploying automated checks so cross-tenant data leaks never reach production. Secure SDLC Automation: Build security into CI/CD pipelines as code (SAST, SCA, secrets detection, IaC policy), delivering developer feedback in minutes, not sprints, with low noise and clear build-break rules. Edge & Firmware Security: Partner with hardware and embedded teams on device boot security, signed OTA update pipelines, edge credential management, and threat models that assume physical access. AI/ML & Analytics Security: Safeguard our AI vision models, prompt boundaries, and data pipelines against abuse, keeping privacy-by-design at the forefront in a regulated and publicly scrutinized space. AI-Assisted Development Standards: Define guardrails for how LVT engineers use AI coding agents, ensuring AI-generated code meets our standards for safety, testing, and architecture. Compliance as Engineering Artifacts: Turn real product security controls into audit evidence for SOC 2, GovRAMP, FedRAMP, and CJIS through native engineering workflows instead of manual compliance exercises. Incident Response & Disclosure: Oversee external vulnerability intake, triage, and coordinated disclosure (VDP/bug bounty), and lead engineering response to product security incidents. Observability & Systemic Defenses: Partner with SecOps to instrument telemetry for authorization failures and edge abuse, turning incident learnings into root-cause controls. OUR IDEAL CANDIDATE The Player-Coach Mindset: 10+ years in AppSec or product security, including significant time as a hands-on engineer and 4+ years as a people manager or formal technical lead. You still read code, build automation, and hold your own in architecture reviews with principal engineers. Engineering Empathy: You know what it takes to ship software. You've carried a pager, hit deadlines, or maintained a release pipeline. You understand why shortcuts happen and spend your political capital wisely. Cross-Functional Influencer: You can point to releases or system architectures that changed because of an argument you made, and explain how you earned buy-in without pulling rank. Cloud & SaaS Depth: Deep technical grounding in multi-tenant authorization, zero-trust architectures, and API security at scale. Tooling & Code Fluency: Fluent in at least one language in our stack (e.g., Python, Go, TypeScript/Node, C/C++), with the ability to write custom automation, tooling, and CI integrations. Hardware & Firmware Exposure: Familiarity with IoT, embedded platforms, hardware security modules, or OTA update validation, or a proven ability to master physical attack surfaces quickly. AI/ML Security Literate: Understanding of model supply chain risks, data handling during inference, and security reviews for AI-augmented features. Metrics-Driven: You know the difference between a tool and a program. You measure success by coverage, adoption, defect recurrence, and remediation velocity. Location: Based onsite out of our headquarters in American Fork, Utah. Bonus Points: Experience in video streaming, computer vision, or physical safety products; hands-on work in regulated spaces (FedRAMP, GovRAMP, StateRAMP, CJIS); a track record scaling a formal Security Champions program or running a VDP/bug bounty. BENEFITS We believe you do your best work when your whole life is supported. We invest in our crew's health, families, and financial futures with a benefits package designed to support you inside and outside the office. Full-time benefits include, but not limited to: Comprehensive health, dental and vision coverage, retirement benefits (401k match up to 4%), and flexible PTO. LVT IS PROUD TO BE AN EQUAL OPPORTUNITY EMPLOYER. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status. All candidates must pass a drug screening and background check upon employment. Some roles may also require passing a federal background check and fingerprinting. Must be authorized to work in the U.S. If reasonable accommodation is needed to participate in the job application or interview process, and/or to perform essential job functions, please reach out to your recruiter.
Job Description Senior Cybersecurity Manager - Enterprise Security Operations & Risk Location: Greater Chicago Area / Southern Wisconsin Employment: Full-Time Direct Hire Work Authorization: Must be authorized to work in the U.S. without current or future employer sponsorship. About the Role Identify Security is seeking a Senior Cybersecurity Manager for a confidential global enterprise. This role requires a technically credible security leader who can manage cybersecurity operations, lead analysts and engineers, oversee incident response, and drive measurable risk reduction across infrastructure, cloud, and application teams. The ideal candidate has progressed from hands-on cybersecurity engineering or operations into leadership while maintaining strong technical judgment. Key Responsibilities Lead and develop a team of cybersecurity analysts and engineers supporting global security operations. Oversee threat detection, incident response, escalation, and security monitoring. Manage enterprise vulnerability management, risk prioritization, remediation tracking, and control validation. Drive remediation across infrastructure, cloud, application, and business teams. Oversee SIEM, EDR, email security, identity, firewall, and cloud security capabilities. Manage MSSP relationships, vendor performance, and security technology effectiveness. Establish security metrics, KPIs, and executive risk reporting aligned with NIST CSF. Support security governance, compliance, third-party risk, and security awareness initiatives. Partner with IT and application teams on Azure security, architecture reviews, and secure development practices. Required Experience 10+ years of cybersecurity experience with at least 2 years in a leadership or supervisory role. Direct experience managing enterprise security operations and incident response. Demonstrated ownership of vulnerability management and remediation across multiple technical teams. Strong technical understanding of SIEM, EDR, IAM, network security, and cloud security. Experience leading cybersecurity analysts or engineers. Experience managing MSSPs and security technology providers. Familiarity with NIST CSF, ISO 27001, or CIS Controls. Ability to translate technical security risks into business priorities and measurable outcomes. Preferred Experience Microsoft Azure and Microsoft 365 security. Rapid7, CrowdStrike, Proofpoint, Cisco Umbrella, or equivalent technologies. Third-party risk management program development. Application security, SDLC, and AI governance. Global or distributed enterprise environments. CISSP, CISM, CISA, or relevant cloud security certifications. Right Fit vs. Wrong Fit Strong Fit: A cybersecurity operations or security engineering leader who has managed technical teams, directed incident response, driven vulnerability remediation to closure, and demonstrated measurable improvements in enterprise security posture. Not the Right Fit: A GRC-only manager, SOC monitoring manager, security architect, or cloud/AppSec specialist without broader enterprise security operations, remediation ownership, and people leadership experience. About Identify Security Identify Security specializes in connecting organizations with experienced cybersecurity professionals. This is a confidential, full-time direct-hire opportunity with an established global organization.
11/06/2026
Full time
Job Description Senior Cybersecurity Manager - Enterprise Security Operations & Risk Location: Greater Chicago Area / Southern Wisconsin Employment: Full-Time Direct Hire Work Authorization: Must be authorized to work in the U.S. without current or future employer sponsorship. About the Role Identify Security is seeking a Senior Cybersecurity Manager for a confidential global enterprise. This role requires a technically credible security leader who can manage cybersecurity operations, lead analysts and engineers, oversee incident response, and drive measurable risk reduction across infrastructure, cloud, and application teams. The ideal candidate has progressed from hands-on cybersecurity engineering or operations into leadership while maintaining strong technical judgment. Key Responsibilities Lead and develop a team of cybersecurity analysts and engineers supporting global security operations. Oversee threat detection, incident response, escalation, and security monitoring. Manage enterprise vulnerability management, risk prioritization, remediation tracking, and control validation. Drive remediation across infrastructure, cloud, application, and business teams. Oversee SIEM, EDR, email security, identity, firewall, and cloud security capabilities. Manage MSSP relationships, vendor performance, and security technology effectiveness. Establish security metrics, KPIs, and executive risk reporting aligned with NIST CSF. Support security governance, compliance, third-party risk, and security awareness initiatives. Partner with IT and application teams on Azure security, architecture reviews, and secure development practices. Required Experience 10+ years of cybersecurity experience with at least 2 years in a leadership or supervisory role. Direct experience managing enterprise security operations and incident response. Demonstrated ownership of vulnerability management and remediation across multiple technical teams. Strong technical understanding of SIEM, EDR, IAM, network security, and cloud security. Experience leading cybersecurity analysts or engineers. Experience managing MSSPs and security technology providers. Familiarity with NIST CSF, ISO 27001, or CIS Controls. Ability to translate technical security risks into business priorities and measurable outcomes. Preferred Experience Microsoft Azure and Microsoft 365 security. Rapid7, CrowdStrike, Proofpoint, Cisco Umbrella, or equivalent technologies. Third-party risk management program development. Application security, SDLC, and AI governance. Global or distributed enterprise environments. CISSP, CISM, CISA, or relevant cloud security certifications. Right Fit vs. Wrong Fit Strong Fit: A cybersecurity operations or security engineering leader who has managed technical teams, directed incident response, driven vulnerability remediation to closure, and demonstrated measurable improvements in enterprise security posture. Not the Right Fit: A GRC-only manager, SOC monitoring manager, security architect, or cloud/AppSec specialist without broader enterprise security operations, remediation ownership, and people leadership experience. About Identify Security Identify Security specializes in connecting organizations with experienced cybersecurity professionals. This is a confidential, full-time direct-hire opportunity with an established global organization.
Job Description Job Description Application Security Engineer Location: Remote (United States) Type of Role: Full-Time Overview An organization is seeking an Application Security Engineer to build and mature its application security program, embedding security across the software development lifecycle (SDLC) and championing Security by Design principles. As a leader in clinical genetic testing, the organization handles highly sensitive patient data across its web, API, and pipeline applications, and this role is central to protecting that data and reducing risk. The engineer will implement and manage static and dynamic code analysis tooling including SonarQube and BURP partner closely with engineering to remediate findings, and help close audit-identified gaps in secure coding, software composition analysis, and code review coverage. This role directly supports HIPAA compliance and organizational risk reduction; scope may evolve as organizational needs change. Key Responsibilities Implement and manage static and dynamic code analysis, integrating SonarQube (and complementary SAST/DAST/SCA tools) into CI/CD pipelines and check-in scans, and partner with engineering to triage and remediate findings. Perform penetration tests and vulnerability assessments across web, API, and pipeline applications, and lead consistent, timely remediation of identified findings. Develop and maintain a structured remediation program that addresses and resolves security findings quickly, consistently, and in priority order. Evolve the organization's SDLC into a Secure SDLC (SSDLC) by embedding Security by Design and Privacy by Design principles at every stage. Integrate secure coding practices with development teams, providing guidance, threat modeling, and secure architecture reviews for new features and releases. Generate regular reports on the status of application security initiatives, vulnerability management, and risk assessments for technical and executive audiences. Collaborate with auditors during internal and external audits, providing explanations, evidence, and documentation, and draft security policies and procedures as needed. Partner cross-functionally with IT, Privacy, Compliance, and business units to support initiatives and drive measurable risk reduction. Required Experience & Skills Bachelor's degree in Computer Science, Cybersecurity, Information Security, or a related field or an equivalent combination of education and experience. Minimum of 3 5 years of experience in application security, DevSecOps, or software engineering with a security focus. Hands-on experience with SonarQube for static code analysis and code quality/security gating. Experience with SAST, DAST, SCA, and IAST tooling and integrating them into CI/CD pipelines. Working knowledge of the OWASP Top 10, common attack vectors, and secure coding practices in languages such as Java, C#/.NET, Python, and JavaScript. Familiarity with penetration testing, code review, and vulnerability management processes. Understanding of compliance frameworks and regulations relevant to healthcare data, including HIPAA, NIST, and GDPR. Excellent written and verbal communication skills, with the ability to translate technical risk for non-technical stakeholders and collaborate cross-functionally. Detail-oriented, self-directed, and able to prioritize in a fast-moving environment. Nice to Have Relevant industry certifications such as OSCP, CSSLP, GWAPT, CISSP, or equivalent. Experience securing web applications, APIs, and cloud- native/containerized workloads. Knowledge of authentication and authorization frameworks (e.g., SAML, OAuth, OpenID Connect). Prior experience in a healthcare, clinical laboratory, or other regulated (HIPAA/PHI) environment.
11/06/2026
Full time
Job Description Job Description Application Security Engineer Location: Remote (United States) Type of Role: Full-Time Overview An organization is seeking an Application Security Engineer to build and mature its application security program, embedding security across the software development lifecycle (SDLC) and championing Security by Design principles. As a leader in clinical genetic testing, the organization handles highly sensitive patient data across its web, API, and pipeline applications, and this role is central to protecting that data and reducing risk. The engineer will implement and manage static and dynamic code analysis tooling including SonarQube and BURP partner closely with engineering to remediate findings, and help close audit-identified gaps in secure coding, software composition analysis, and code review coverage. This role directly supports HIPAA compliance and organizational risk reduction; scope may evolve as organizational needs change. Key Responsibilities Implement and manage static and dynamic code analysis, integrating SonarQube (and complementary SAST/DAST/SCA tools) into CI/CD pipelines and check-in scans, and partner with engineering to triage and remediate findings. Perform penetration tests and vulnerability assessments across web, API, and pipeline applications, and lead consistent, timely remediation of identified findings. Develop and maintain a structured remediation program that addresses and resolves security findings quickly, consistently, and in priority order. Evolve the organization's SDLC into a Secure SDLC (SSDLC) by embedding Security by Design and Privacy by Design principles at every stage. Integrate secure coding practices with development teams, providing guidance, threat modeling, and secure architecture reviews for new features and releases. Generate regular reports on the status of application security initiatives, vulnerability management, and risk assessments for technical and executive audiences. Collaborate with auditors during internal and external audits, providing explanations, evidence, and documentation, and draft security policies and procedures as needed. Partner cross-functionally with IT, Privacy, Compliance, and business units to support initiatives and drive measurable risk reduction. Required Experience & Skills Bachelor's degree in Computer Science, Cybersecurity, Information Security, or a related field or an equivalent combination of education and experience. Minimum of 3 5 years of experience in application security, DevSecOps, or software engineering with a security focus. Hands-on experience with SonarQube for static code analysis and code quality/security gating. Experience with SAST, DAST, SCA, and IAST tooling and integrating them into CI/CD pipelines. Working knowledge of the OWASP Top 10, common attack vectors, and secure coding practices in languages such as Java, C#/.NET, Python, and JavaScript. Familiarity with penetration testing, code review, and vulnerability management processes. Understanding of compliance frameworks and regulations relevant to healthcare data, including HIPAA, NIST, and GDPR. Excellent written and verbal communication skills, with the ability to translate technical risk for non-technical stakeholders and collaborate cross-functionally. Detail-oriented, self-directed, and able to prioritize in a fast-moving environment. Nice to Have Relevant industry certifications such as OSCP, CSSLP, GWAPT, CISSP, or equivalent. Experience securing web applications, APIs, and cloud- native/containerized workloads. Knowledge of authentication and authorization frameworks (e.g., SAML, OAuth, OpenID Connect). Prior experience in a healthcare, clinical laboratory, or other regulated (HIPAA/PHI) environment.
Systems Engineering Solutions Corporation
Hanscom Afb, Massachusetts
Job Description Job Description This role supports the U.S. Air Force Cloud One Architecture and Common Shared Services contract and currently has an opening for a Cloud Security Architect . This position will coordinate across multiple areas as the program supports AWS, Azure, Google, and Oracle clouds. This is an exciting opportunity to use your experience to modernize a leading, global-scale multi-cloud environment in support of a critical mission, supporting USAF system resiliency, security, and cost effectiveness. Location: This position will be on-site with some ad-hoc remote work available. Candidates need to be located near Hanscom AFB (Boston, MA). Responsibilities: We are seeking highly capable Cloud Architects with expertise in multiple cloud platforms. A successful individual will be responsible for designing scalable cloud-native solutions, leading development efforts, and ensuring best practices across architecture, development, deployment, and security. This is a combination management and hands-on technical role that requires rolling up your sleeves to architect, code, debug, and mentor. Design, deploy, configure, operate, and maintain authorizations and accreditation of the C1 Architecture for Amazon Web Services, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure in NIPRNet and SIPRNet. Serve as Subject Matter Expert (SME) for all IT stakeholders involved with system design, system builds, and Authority to Operate (ATO) efforts on cybersecurity requirements and tooling. Support the cybersecurity authorizations team developing artifacts required to achieve milestones such as Interim Authority Test (IATT) and Authorization to Operate (ATO). Experience engineering solutions to support migration of security controls from NIST 800-53 Rev 4 to 800-53 Rev 5. Ensure compliance with SCCA, Cloud SRG, and other STIG/SRG requirements. Support Continuous Authorization to Operate (cATO) within a DevSecOps or cloud-based environment, including implementation of automated control validation, continuous monitoring integration, and real-time POA&M management. Create RMF-required authorization-related documentation and artifacts and support ATO sustainment activities for C1 and DPaaS environments. Conduct routine Insider Threat Assessment and document results in the Contractor's System Security Plan Continuously monitor system resources through automated scanning and implement automated reporting feeds to support cybersecurity authorizations. Verify patch compliance using the approved technical solutions and conduct remediation activities. Provide and execute a plan for enterprise vulnerability and compliance scanning. Implementation of security procedures, and verify information system security requirements, including coordinating the execution, review, and disposition of STIG checklists for systems, applications, developed code and other components. Participate in regular briefings with the customer on cybersecurity status, including preparing briefing materials Work closely with government Cyber & technical teams to support ATO conditions and requirements. Prepare detailed technical documentation to support development and operational processes Collaborate with team members and provide mentorship to junior staff, fostering a learning environment Create reference architectures, design patterns, and technical standards for cloud implementations. Requirements Bachelor's Degree and 8+ years or more of experience; Master's and 6+ years or more of experience, additional years of experience may be accepted in lieu of degree. Must have an active Secret clearance. US citizenship required. Interim Secret clearance required to start; Ability to obtain Secret clearance required to maintain employment Certifications: DoD 8570/8140 IAT Level II baseline certification (e.g., Security+ CE, CySA+, or equivalent) AWS Certified Security - SpecialtyACAS Certified - Supervisor/OperatorHands -on experience with AWS CLI, Ansible Playbooks, Tenable Nessus, and implementing and remediating DISA Security Technical Implementation Guides (STIGs). Preferred Skills Experience with USAF Cloud One or Platform 1. Experience with Zero Trust Architecture. Experience with USAF Cloud One or Platform 1 Experience with automation/tools like EvalSTIG, STIG Manager, Ansible etc. Cloud certifications in AWS, ACAS, and Cloud Native Services, DoD ACAS certified Certifications: CISSP or equivalent (IAT-3) Benefits SES provides a competitive salary and the following benefits: Medical Dental Vision AD&D STD LTD Company paid Life Insurance 401k with employer contribution Paid Time Off Pet Insurance
11/06/2026
Full time
Job Description Job Description This role supports the U.S. Air Force Cloud One Architecture and Common Shared Services contract and currently has an opening for a Cloud Security Architect . This position will coordinate across multiple areas as the program supports AWS, Azure, Google, and Oracle clouds. This is an exciting opportunity to use your experience to modernize a leading, global-scale multi-cloud environment in support of a critical mission, supporting USAF system resiliency, security, and cost effectiveness. Location: This position will be on-site with some ad-hoc remote work available. Candidates need to be located near Hanscom AFB (Boston, MA). Responsibilities: We are seeking highly capable Cloud Architects with expertise in multiple cloud platforms. A successful individual will be responsible for designing scalable cloud-native solutions, leading development efforts, and ensuring best practices across architecture, development, deployment, and security. This is a combination management and hands-on technical role that requires rolling up your sleeves to architect, code, debug, and mentor. Design, deploy, configure, operate, and maintain authorizations and accreditation of the C1 Architecture for Amazon Web Services, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure in NIPRNet and SIPRNet. Serve as Subject Matter Expert (SME) for all IT stakeholders involved with system design, system builds, and Authority to Operate (ATO) efforts on cybersecurity requirements and tooling. Support the cybersecurity authorizations team developing artifacts required to achieve milestones such as Interim Authority Test (IATT) and Authorization to Operate (ATO). Experience engineering solutions to support migration of security controls from NIST 800-53 Rev 4 to 800-53 Rev 5. Ensure compliance with SCCA, Cloud SRG, and other STIG/SRG requirements. Support Continuous Authorization to Operate (cATO) within a DevSecOps or cloud-based environment, including implementation of automated control validation, continuous monitoring integration, and real-time POA&M management. Create RMF-required authorization-related documentation and artifacts and support ATO sustainment activities for C1 and DPaaS environments. Conduct routine Insider Threat Assessment and document results in the Contractor's System Security Plan Continuously monitor system resources through automated scanning and implement automated reporting feeds to support cybersecurity authorizations. Verify patch compliance using the approved technical solutions and conduct remediation activities. Provide and execute a plan for enterprise vulnerability and compliance scanning. Implementation of security procedures, and verify information system security requirements, including coordinating the execution, review, and disposition of STIG checklists for systems, applications, developed code and other components. Participate in regular briefings with the customer on cybersecurity status, including preparing briefing materials Work closely with government Cyber & technical teams to support ATO conditions and requirements. Prepare detailed technical documentation to support development and operational processes Collaborate with team members and provide mentorship to junior staff, fostering a learning environment Create reference architectures, design patterns, and technical standards for cloud implementations. Requirements Bachelor's Degree and 8+ years or more of experience; Master's and 6+ years or more of experience, additional years of experience may be accepted in lieu of degree. Must have an active Secret clearance. US citizenship required. Interim Secret clearance required to start; Ability to obtain Secret clearance required to maintain employment Certifications: DoD 8570/8140 IAT Level II baseline certification (e.g., Security+ CE, CySA+, or equivalent) AWS Certified Security - SpecialtyACAS Certified - Supervisor/OperatorHands -on experience with AWS CLI, Ansible Playbooks, Tenable Nessus, and implementing and remediating DISA Security Technical Implementation Guides (STIGs). Preferred Skills Experience with USAF Cloud One or Platform 1. Experience with Zero Trust Architecture. Experience with USAF Cloud One or Platform 1 Experience with automation/tools like EvalSTIG, STIG Manager, Ansible etc. Cloud certifications in AWS, ACAS, and Cloud Native Services, DoD ACAS certified Certifications: CISSP or equivalent (IAT-3) Benefits SES provides a competitive salary and the following benefits: Medical Dental Vision AD&D STD LTD Company paid Life Insurance 401k with employer contribution Paid Time Off Pet Insurance
Systems Engineering Solutions Corporation
Boston, Massachusetts
Job Description Job Description This role supports the U.S. Air Force Cloud One Architecture and Common Shared Services contract and currently has an opening for a Cloud Security Architect . This position will coordinate across multiple areas as the program supports AWS, Azure, Google, and Oracle clouds. This is an exciting opportunity to use your experience to modernize a leading, global-scale multi-cloud environment in support of a critical mission, supporting USAF system resiliency, security, and cost effectiveness. Location: This position will be on-site with some ad-hoc remote work available. Candidates need to be located near Hanscom AFB (Boston, MA). Responsibilities: We are seeking highly capable Cloud Architects with expertise in multiple cloud platforms. A successful individual will be responsible for designing scalable cloud-native solutions, leading development efforts, and ensuring best practices across architecture, development, deployment, and security. This is a combination management and hands-on technical role that requires rolling up your sleeves to architect, code, debug, and mentor. Design, deploy, configure, operate, and maintain authorizations and accreditation of the C1 Architecture for Amazon Web Services, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure in NIPRNet and SIPRNet. Serve as Subject Matter Expert (SME) for all IT stakeholders involved with system design, system builds, and Authority to Operate (ATO) efforts on cybersecurity requirements and tooling. Support the cybersecurity authorizations team developing artifacts required to achieve milestones such as Interim Authority Test (IATT) and Authorization to Operate (ATO). Experience engineering solutions to support migration of security controls from NIST 800-53 Rev 4 to 800-53 Rev 5. Ensure compliance with SCCA, Cloud SRG, and other STIG/SRG requirements. Support Continuous Authorization to Operate (cATO) within a DevSecOps or cloud-based environment, including implementation of automated control validation, continuous monitoring integration, and real-time POA&M management. Create RMF-required authorization-related documentation and artifacts and support ATO sustainment activities for C1 and DPaaS environments. Conduct routine Insider Threat Assessment and document results in the Contractor's System Security Plan Continuously monitor system resources through automated scanning and implement automated reporting feeds to support cybersecurity authorizations. Verify patch compliance using the approved technical solutions and conduct remediation activities. Provide and execute a plan for enterprise vulnerability and compliance scanning. Implementation of security procedures, and verify information system security requirements, including coordinating the execution, review, and disposition of STIG checklists for systems, applications, developed code and other components. Participate in regular briefings with the customer on cybersecurity status, including preparing briefing materials Work closely with government Cyber & technical teams to support ATO conditions and requirements. Prepare detailed technical documentation to support development and operational processes Collaborate with team members and provide mentorship to junior staff, fostering a learning environment Create reference architectures, design patterns, and technical standards for cloud implementations. Requirements Bachelor's Degree and 8+ years or more of experience; Master's and 6+ years or more of experience, additional years of experience may be accepted in lieu of degree. Must have an active Secret clearance. US citizenship required. Interim Secret clearance required to start; Ability to obtain Secret clearance required to maintain employment Certifications: DoD 8570/8140 IAT Level II baseline certification (e.g., Security+ CE, CySA+, or equivalent) AWS Certified Security - SpecialtyACAS Certified - Supervisor/OperatorHands -on experience with AWS CLI, Ansible Playbooks, Tenable Nessus, and implementing and remediating DISA Security Technical Implementation Guides (STIGs). Preferred Skills Experience with USAF Cloud One or Platform 1. Experience with Zero Trust Architecture. Experience with USAF Cloud One or Platform 1 Experience with automation/tools like EvalSTIG, STIG Manager, Ansible etc. Cloud certifications in AWS, ACAS, and Cloud Native Services, DoD ACAS certified Certifications: CISSP or equivalent (IAT-3) Benefits SES provides a competitive salary and the following benefits: Medical Dental Vision AD&D STD LTD Company paid Life Insurance 401k with employer contribution Paid Time Off Pet Insurance
11/06/2026
Full time
Job Description Job Description This role supports the U.S. Air Force Cloud One Architecture and Common Shared Services contract and currently has an opening for a Cloud Security Architect . This position will coordinate across multiple areas as the program supports AWS, Azure, Google, and Oracle clouds. This is an exciting opportunity to use your experience to modernize a leading, global-scale multi-cloud environment in support of a critical mission, supporting USAF system resiliency, security, and cost effectiveness. Location: This position will be on-site with some ad-hoc remote work available. Candidates need to be located near Hanscom AFB (Boston, MA). Responsibilities: We are seeking highly capable Cloud Architects with expertise in multiple cloud platforms. A successful individual will be responsible for designing scalable cloud-native solutions, leading development efforts, and ensuring best practices across architecture, development, deployment, and security. This is a combination management and hands-on technical role that requires rolling up your sleeves to architect, code, debug, and mentor. Design, deploy, configure, operate, and maintain authorizations and accreditation of the C1 Architecture for Amazon Web Services, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure in NIPRNet and SIPRNet. Serve as Subject Matter Expert (SME) for all IT stakeholders involved with system design, system builds, and Authority to Operate (ATO) efforts on cybersecurity requirements and tooling. Support the cybersecurity authorizations team developing artifacts required to achieve milestones such as Interim Authority Test (IATT) and Authorization to Operate (ATO). Experience engineering solutions to support migration of security controls from NIST 800-53 Rev 4 to 800-53 Rev 5. Ensure compliance with SCCA, Cloud SRG, and other STIG/SRG requirements. Support Continuous Authorization to Operate (cATO) within a DevSecOps or cloud-based environment, including implementation of automated control validation, continuous monitoring integration, and real-time POA&M management. Create RMF-required authorization-related documentation and artifacts and support ATO sustainment activities for C1 and DPaaS environments. Conduct routine Insider Threat Assessment and document results in the Contractor's System Security Plan Continuously monitor system resources through automated scanning and implement automated reporting feeds to support cybersecurity authorizations. Verify patch compliance using the approved technical solutions and conduct remediation activities. Provide and execute a plan for enterprise vulnerability and compliance scanning. Implementation of security procedures, and verify information system security requirements, including coordinating the execution, review, and disposition of STIG checklists for systems, applications, developed code and other components. Participate in regular briefings with the customer on cybersecurity status, including preparing briefing materials Work closely with government Cyber & technical teams to support ATO conditions and requirements. Prepare detailed technical documentation to support development and operational processes Collaborate with team members and provide mentorship to junior staff, fostering a learning environment Create reference architectures, design patterns, and technical standards for cloud implementations. Requirements Bachelor's Degree and 8+ years or more of experience; Master's and 6+ years or more of experience, additional years of experience may be accepted in lieu of degree. Must have an active Secret clearance. US citizenship required. Interim Secret clearance required to start; Ability to obtain Secret clearance required to maintain employment Certifications: DoD 8570/8140 IAT Level II baseline certification (e.g., Security+ CE, CySA+, or equivalent) AWS Certified Security - SpecialtyACAS Certified - Supervisor/OperatorHands -on experience with AWS CLI, Ansible Playbooks, Tenable Nessus, and implementing and remediating DISA Security Technical Implementation Guides (STIGs). Preferred Skills Experience with USAF Cloud One or Platform 1. Experience with Zero Trust Architecture. Experience with USAF Cloud One or Platform 1 Experience with automation/tools like EvalSTIG, STIG Manager, Ansible etc. Cloud certifications in AWS, ACAS, and Cloud Native Services, DoD ACAS certified Certifications: CISSP or equivalent (IAT-3) Benefits SES provides a competitive salary and the following benefits: Medical Dental Vision AD&D STD LTD Company paid Life Insurance 401k with employer contribution Paid Time Off Pet Insurance
Wilson Elser - Business & Legal Professionals
New York, New York
Job Description Job Description At Wilson Elser, we are redefining what it means to work at a national law firm. With more than 1,400 attorneys across 46 offices nationwide, we are recognized among the top 100 law firms by The American Lawyer and ranked in the National Law Journal's survey of the nation's largest law firms. Our continued success is built on a culture of collaboration, innovation, client service, and mutual respect. We are committed to fostering an environment where employees are empowered to grow their careers, contribute meaningfully, and thrive professionally. The Position We are seeking a Senior Product Security Engineer to build and lead our secure software development and DevSecOps program. This is a program-building role for someone who has stood up application security from the ground up and can set its direction as the Firm continues its move to Azure. You will serve as the bridge between Information Security and Application Development, embedding security into the development lifecycle without slowing delivery. The work spans internally developed applications, CI/CD pipelines, integrations, low-code/no-code platforms, and Azure-hosted services, and includes carrying security practices from the Firm's traditional Windows infrastructure into cloud-native Azure patterns. The role reports to Information Security with a strong dotted-line partnership into Application Development and Engineering leadership. Key Responsibilities Application Security & Secure Development Lifecycle (SDL) Build, lead, and mature the SSDLC program, including its roadmap, standards, and success measures Prioritize preventive controls designed into the build process ("baked in, not sprayed on"), using testing to validate secure design rather than replace it Perform application security reviews, threat modeling, secure architecture assessments, and source code review Establish secure coding standards, policies, and "paved road" patterns for common technologies and frameworks DevSecOps & CI/CD Security Integrate and optimize SAST, DAST, SCA, API scanning, and IaC scanning within Azure DevOps pipelines Own vulnerability ingestion, triage, prioritization, remediation tracking, and reporting Build dashboards and metrics covering application security posture and remediation SLAs Script integrations to normalize findings across multiple security tools Security Tooling Administer and tune Snyk, SonarQube, Azure DevOps, PowerShell scanning tools, and additional AppSec tooling as needed Suppress false positives, write custom detection rules, and identify gaps in tooling coverage Manage security exceptions and remediation timelines with development teams Cloud & Platform Security Partner with cloud and infrastructure teams to secure Azure-hosted applications and services Support security reviews across Azure PaaS, containers, Databricks, MongoDB, Data Lake environments, Azure Data Factory, and Power Platform Help secure low-code/no-code platforms and their governance processes Developer Enablement Launch and run a Security Champions program within engineering teams Deliver developer-focused training, workshops, and secure coding guidance Mentor developers and upskill Information Security staff on application security concepts and tooling Qualifications 5+ years in Application Security, Product Security, DevSecOps, or Software Engineering Demonstrated experience building an application security or DevSecOps program from the ground up Experience leading or mentoring technical staff, formally or informally Hands-on experience securing Azure environments and Azure DevOps pipelines, and integrating security tooling into CI/CD Experience with Microsoft/Windows environments and .NET application stacks Strong grounding in secure coding principles, OWASP Top 10, secure SDLC, threat modeling, and vulnerability management Working experience with several of: Azure DevOps, Azure cloud services, Snyk, SonarQube, containers/Kubernetes, PowerShell, Python, .NET, JavaScript, React, PHP Ability to separate meaningful risk from low-value scanner findings Strong scripting and automation skills, with excellent communication and documentation Preferred Qualifications Prior experience as a software developer or DevOps engineer Hands-on administration of Snyk and SonarQube Experience bridging on-premises infrastructure to Azure, including container and cloud-native application security Familiarity with low-code/no-code platform security and with OWASP ASVS, Azure Security Benchmark, or CIS Benchmarks Experience building Security Champion programs and presenting to both engineers and leadership Certifications such as CSSLP, OSWE, GWAPT, or Azure/Kubernetes security credentials Leadership presence, with the ability to set direction and influence without direct authority. Pragmatic, collaborative, and enablement-focused rather than friction-creating, with the judgment to balance security requirements against development velocity. Strong ownership mentality, comfortable learning new technologies and operating independently. Success Metrics (First 6-12 months) Program roadmap defined and agreed with Information Security and engineering leadership Security tooling integrated consistently across pipelines, with vulnerability management workflows and dashboards operational Security Champions program launched and development teams actively engaging with security processes Secure coding standards and reusable templates established Measurable reduction in unresolved high-risk findings Wilson Elser offers a competitive salary and benefits package designed to support our attorneys both professionally and personally. A variety of factors are considered in making compensation decisions, including but not limited to experience, education, licensure and/or certifications, geographic location, market demands, other business and organizational needs, and other factors permitted by law. Final salary wages offered may be outside of this range based on other reasons and individual circumstances. This position is considered full-time and therefore qualifies for benefits including 401(k) retirement savings plan, medical, dental, vision, disability, and life insurance. Details of participation in these benefit plans will be provided if an employee receives an offer of employment. Salary Range: $150,000-$180,000 USD Why Should You Apply? Benefits: Outstanding benefits package, including 401k match and generous PTO plan Career Growth: Ample opportunities for professional development and advancement Employee Perks: Access to corporate discount plans and other benefits Wilson Elser welcomes submissions of candidates for our open positions exclusively from recruitment agencies with an active, signed fee agreement who have been granted access to a position through our dedicated Recruitment Agency Portal. We are unable to consider submissions from recruitment agencies without a current (dated as of 7/1/2024) agreement in place. We appreciate your understanding. For collaboration inquiries or to establish an agreement, please contact us at . Wilson Elser is committed to a collegial work environment in which all individuals are treated with respect and dignity. It is the Firm's policy that employment will be based on merit, qualifications, and competence. Further, employment decisions will be made without regard to an applicants race, color, age, sex, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation or preference, gender identity, physical or mental disability, status as a victim of domestic violence, sex offenses, or stalking, past or present service in the uniformed services or application or obligation to serve in the uniformed services, or any other characteristic protected by law. Wilson Elser endeavors to make the Wilson Elser website accessible to any and all users. You may review our Accessibility Policy here. California Residents may review our CCPA notice for applicants and employees here. Wilson Elser participates in the federal E-Verify program. With respect to all new hires, we provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS) with information from each new employee's Form I-9 to confirm work authorization. Please review the official posters for detailed information regarding your rights and protections Download the E-Verify Participation Poster (English & Spanish) Download the Right to Work Poster (English & Spanish)
11/06/2026
Full time
Job Description Job Description At Wilson Elser, we are redefining what it means to work at a national law firm. With more than 1,400 attorneys across 46 offices nationwide, we are recognized among the top 100 law firms by The American Lawyer and ranked in the National Law Journal's survey of the nation's largest law firms. Our continued success is built on a culture of collaboration, innovation, client service, and mutual respect. We are committed to fostering an environment where employees are empowered to grow their careers, contribute meaningfully, and thrive professionally. The Position We are seeking a Senior Product Security Engineer to build and lead our secure software development and DevSecOps program. This is a program-building role for someone who has stood up application security from the ground up and can set its direction as the Firm continues its move to Azure. You will serve as the bridge between Information Security and Application Development, embedding security into the development lifecycle without slowing delivery. The work spans internally developed applications, CI/CD pipelines, integrations, low-code/no-code platforms, and Azure-hosted services, and includes carrying security practices from the Firm's traditional Windows infrastructure into cloud-native Azure patterns. The role reports to Information Security with a strong dotted-line partnership into Application Development and Engineering leadership. Key Responsibilities Application Security & Secure Development Lifecycle (SDL) Build, lead, and mature the SSDLC program, including its roadmap, standards, and success measures Prioritize preventive controls designed into the build process ("baked in, not sprayed on"), using testing to validate secure design rather than replace it Perform application security reviews, threat modeling, secure architecture assessments, and source code review Establish secure coding standards, policies, and "paved road" patterns for common technologies and frameworks DevSecOps & CI/CD Security Integrate and optimize SAST, DAST, SCA, API scanning, and IaC scanning within Azure DevOps pipelines Own vulnerability ingestion, triage, prioritization, remediation tracking, and reporting Build dashboards and metrics covering application security posture and remediation SLAs Script integrations to normalize findings across multiple security tools Security Tooling Administer and tune Snyk, SonarQube, Azure DevOps, PowerShell scanning tools, and additional AppSec tooling as needed Suppress false positives, write custom detection rules, and identify gaps in tooling coverage Manage security exceptions and remediation timelines with development teams Cloud & Platform Security Partner with cloud and infrastructure teams to secure Azure-hosted applications and services Support security reviews across Azure PaaS, containers, Databricks, MongoDB, Data Lake environments, Azure Data Factory, and Power Platform Help secure low-code/no-code platforms and their governance processes Developer Enablement Launch and run a Security Champions program within engineering teams Deliver developer-focused training, workshops, and secure coding guidance Mentor developers and upskill Information Security staff on application security concepts and tooling Qualifications 5+ years in Application Security, Product Security, DevSecOps, or Software Engineering Demonstrated experience building an application security or DevSecOps program from the ground up Experience leading or mentoring technical staff, formally or informally Hands-on experience securing Azure environments and Azure DevOps pipelines, and integrating security tooling into CI/CD Experience with Microsoft/Windows environments and .NET application stacks Strong grounding in secure coding principles, OWASP Top 10, secure SDLC, threat modeling, and vulnerability management Working experience with several of: Azure DevOps, Azure cloud services, Snyk, SonarQube, containers/Kubernetes, PowerShell, Python, .NET, JavaScript, React, PHP Ability to separate meaningful risk from low-value scanner findings Strong scripting and automation skills, with excellent communication and documentation Preferred Qualifications Prior experience as a software developer or DevOps engineer Hands-on administration of Snyk and SonarQube Experience bridging on-premises infrastructure to Azure, including container and cloud-native application security Familiarity with low-code/no-code platform security and with OWASP ASVS, Azure Security Benchmark, or CIS Benchmarks Experience building Security Champion programs and presenting to both engineers and leadership Certifications such as CSSLP, OSWE, GWAPT, or Azure/Kubernetes security credentials Leadership presence, with the ability to set direction and influence without direct authority. Pragmatic, collaborative, and enablement-focused rather than friction-creating, with the judgment to balance security requirements against development velocity. Strong ownership mentality, comfortable learning new technologies and operating independently. Success Metrics (First 6-12 months) Program roadmap defined and agreed with Information Security and engineering leadership Security tooling integrated consistently across pipelines, with vulnerability management workflows and dashboards operational Security Champions program launched and development teams actively engaging with security processes Secure coding standards and reusable templates established Measurable reduction in unresolved high-risk findings Wilson Elser offers a competitive salary and benefits package designed to support our attorneys both professionally and personally. A variety of factors are considered in making compensation decisions, including but not limited to experience, education, licensure and/or certifications, geographic location, market demands, other business and organizational needs, and other factors permitted by law. Final salary wages offered may be outside of this range based on other reasons and individual circumstances. This position is considered full-time and therefore qualifies for benefits including 401(k) retirement savings plan, medical, dental, vision, disability, and life insurance. Details of participation in these benefit plans will be provided if an employee receives an offer of employment. Salary Range: $150,000-$180,000 USD Why Should You Apply? Benefits: Outstanding benefits package, including 401k match and generous PTO plan Career Growth: Ample opportunities for professional development and advancement Employee Perks: Access to corporate discount plans and other benefits Wilson Elser welcomes submissions of candidates for our open positions exclusively from recruitment agencies with an active, signed fee agreement who have been granted access to a position through our dedicated Recruitment Agency Portal. We are unable to consider submissions from recruitment agencies without a current (dated as of 7/1/2024) agreement in place. We appreciate your understanding. For collaboration inquiries or to establish an agreement, please contact us at . Wilson Elser is committed to a collegial work environment in which all individuals are treated with respect and dignity. It is the Firm's policy that employment will be based on merit, qualifications, and competence. Further, employment decisions will be made without regard to an applicants race, color, age, sex, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation or preference, gender identity, physical or mental disability, status as a victim of domestic violence, sex offenses, or stalking, past or present service in the uniformed services or application or obligation to serve in the uniformed services, or any other characteristic protected by law. Wilson Elser endeavors to make the Wilson Elser website accessible to any and all users. You may review our Accessibility Policy here. California Residents may review our CCPA notice for applicants and employees here. Wilson Elser participates in the federal E-Verify program. With respect to all new hires, we provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS) with information from each new employee's Form I-9 to confirm work authorization. Please review the official posters for detailed information regarding your rights and protections Download the E-Verify Participation Poster (English & Spanish) Download the Right to Work Poster (English & Spanish)
Job Description Job Description Senior Cloud Security Architect Company: AgileEdge Defense LLC Location: Bedford / Hanscom AFB, Massachusetts Employment Type: Full-Time, W-2 Compensation: $210,000-$230,000 annually Work Arrangement: Hybrid, approximately 50% onsite Security Clearance: Active DoD Secret minimum; Top Secret preferred Position Overview AgileEdge Defense (AED), a Service-Disabled Veteran-Owned Small Business (SDVOSB) supporting mission-critical Department of Defense technology and cybersecurity programs, is seeking an exceptional Senior Cloud Security Architect to support the U.S. Air Force Cloud One Next (C1N) Architecture and Common Shared Services (ACSS) program. This senior technical position focuses on designing, securing, and modernizing enterprise multicloud environments supporting critical Air Force missions. We are seeking a proven cybersecurity architect capable of solving complex engineering challenges, developing scalable security solutions, and guiding technical teams through implementation. This is a hands-on architecture and engineering leadership role, not primarily a compliance or ISSM position. The successful candidate will help strengthen mission resilience, implement Zero Trust security principles, and deliver secure, repeatable cloud capabilities across multiple cloud service providers. Key ResponsibilitiesMulticloud Security Architecture Design and integrate enterprise security solutions across AWS, Microsoft Azure, Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI). Develop reusable security architectures, technical standards, and cloud security design patterns. Evaluate cloud-native and third-party technologies for interoperability, scalability, and operational security. Develop architectural prototypes, proofs of concept, and implementation strategies. Identify security gaps and engineer solutions that improve mission resilience. Zero Trust and Identity Security Design Zero Trust architectures aligned with DoD security objectives. Architect identity and access management (IAM), privileged access, MFA, and federated authentication solutions. Develop secure cloud connectivity, segmentation, and workload isolation strategies. Implement least-privilege access principles and secure service-to-service authentication. Integrate enterprise identity, network security, and threat-protection capabilities. Cloud Security Engineering Architect security protections for virtual machines, containers, Kubernetes, serverless applications, and APIs. Design encryption, key management, certificate management, and data protection solutions. Integrate security monitoring, vulnerability management, SIEM, and cloud-native security technologies. Evaluate CNAPP, CSPM, CWPP, and related cloud security platforms. Lead technical resolution of complex security architecture and integration challenges. DevSecOps and Security Automation Integrate security architecture into Infrastructure as Code (IaC), CI/CD pipelines, and automated deployments. Support Terraform, Policy as Code, and automated security validation. Develop reusable security controls and secure cloud engineering patterns. Incorporate container security, vulnerability scanning, and software supply chain protections. Promote secure-by-design development and platform engineering. DoD Cybersecurity and Mission Assurance Align cloud architectures with RMF, NIST SP 800-53, DISA STIGs, and applicable DoD cloud security requirements. Support Authorization to Operate (ATO) readiness, control inheritance, and continuous monitoring. Evaluate technical risks and recommend practical engineering solutions. Support security architecture considerations for applicable DoD cloud impact levels. Strengthen security posture while maintaining operational effectiveness and mission continuity. Technical Leadership Serve as a senior technical advisor to government stakeholders, program leadership, and engineering teams. Lead architectural design reviews, technical evaluations, and security engineering discussions. Develop architecture diagrams, technical decision records, and implementation guidance. Mentor engineers and coordinate across cloud, cybersecurity, networking, and infrastructure teams. Translate complex technical challenges into actionable recommendations for senior leadership. Required Qualifications Bachelor's degree in Cybersecurity, Computer Science, Engineering, Information Technology, or related discipline, with 12+ years of relevant experience; equivalent experience considered. Extensive experience designing and implementing enterprise cybersecurity architectures. Advanced hands-on expertise with at least two major cloud providers: AWS, Azure, GCP, or OCI. Strong knowledge of cloud security architecture, IAM, Zero Trust, encryption, network security, and workload protection. Experience with Infrastructure as Code, DevSecOps, CI/CD, and security automation. Understanding of containers, Kubernetes, and cloud-native application security. Experience supporting DoD, federal, or similarly regulated enterprise environments. Working knowledge of RMF, NIST security controls, and secure system authorization. Demonstrated technical leadership, problem-solving, and communication capabilities. Active DoD Secret clearance or higher. Highly Desired Qualifications Active DoD Top Secret clearance. CISSP, CCSP, CISSP-ISSAP, CISM, or comparable advanced cybersecurity certifications. AWS, Azure, GCP, or OCI cloud security certifications. Experience supporting USAF Cloud One, Cloud One Next, or comparable DoD enterprise cloud programs. Experience with DoD IL4, IL5, or IL6 environments. Expertise in multicloud architecture, Zero Trust implementation, and cloud security modernization. Experience with CNAPP, CSPM, CWPP, SIEM/SOAR, threat modeling, and vulnerability management. Experience developing security automation using Terraform, APIs, and Policy as Code. Experience advising senior government and contractor leadership on mission-critical cybersecurity engineering decisions. Compensation and Benefits AgileEdge Defense offers an annual salary range of $210,000-$230,000 , based on experience, technical qualifications, and clearance. Our comprehensive benefits package includes: Medical, dental, and vision insurance options Company-sponsored 401(k) retirement plan with employer contributions subject to plan provisions Life and accidental insurance benefits Telehealth services Paid time off and applicable federal holidays Professional development and career advancement opportunities Opportunities to support high-impact national defense technology programs Why AgileEdge Defense? AgileEdge Defense is a growing SDVOSB delivering advanced technology, cybersecurity, and mission-support capabilities to the Department of Defense. We offer experienced technical professionals the opportunity to work closely with company leadership, contribute to strategically important defense programs, and help solve some of the nation's most demanding cybersecurity challenges. We value technical excellence, accountability, innovation, and professionals who can turn complex mission requirements into practical, deployable solutions. AgileEdge Defense LLC is an Equal Opportunity Employer.
11/06/2026
Full time
Job Description Job Description Senior Cloud Security Architect Company: AgileEdge Defense LLC Location: Bedford / Hanscom AFB, Massachusetts Employment Type: Full-Time, W-2 Compensation: $210,000-$230,000 annually Work Arrangement: Hybrid, approximately 50% onsite Security Clearance: Active DoD Secret minimum; Top Secret preferred Position Overview AgileEdge Defense (AED), a Service-Disabled Veteran-Owned Small Business (SDVOSB) supporting mission-critical Department of Defense technology and cybersecurity programs, is seeking an exceptional Senior Cloud Security Architect to support the U.S. Air Force Cloud One Next (C1N) Architecture and Common Shared Services (ACSS) program. This senior technical position focuses on designing, securing, and modernizing enterprise multicloud environments supporting critical Air Force missions. We are seeking a proven cybersecurity architect capable of solving complex engineering challenges, developing scalable security solutions, and guiding technical teams through implementation. This is a hands-on architecture and engineering leadership role, not primarily a compliance or ISSM position. The successful candidate will help strengthen mission resilience, implement Zero Trust security principles, and deliver secure, repeatable cloud capabilities across multiple cloud service providers. Key ResponsibilitiesMulticloud Security Architecture Design and integrate enterprise security solutions across AWS, Microsoft Azure, Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI). Develop reusable security architectures, technical standards, and cloud security design patterns. Evaluate cloud-native and third-party technologies for interoperability, scalability, and operational security. Develop architectural prototypes, proofs of concept, and implementation strategies. Identify security gaps and engineer solutions that improve mission resilience. Zero Trust and Identity Security Design Zero Trust architectures aligned with DoD security objectives. Architect identity and access management (IAM), privileged access, MFA, and federated authentication solutions. Develop secure cloud connectivity, segmentation, and workload isolation strategies. Implement least-privilege access principles and secure service-to-service authentication. Integrate enterprise identity, network security, and threat-protection capabilities. Cloud Security Engineering Architect security protections for virtual machines, containers, Kubernetes, serverless applications, and APIs. Design encryption, key management, certificate management, and data protection solutions. Integrate security monitoring, vulnerability management, SIEM, and cloud-native security technologies. Evaluate CNAPP, CSPM, CWPP, and related cloud security platforms. Lead technical resolution of complex security architecture and integration challenges. DevSecOps and Security Automation Integrate security architecture into Infrastructure as Code (IaC), CI/CD pipelines, and automated deployments. Support Terraform, Policy as Code, and automated security validation. Develop reusable security controls and secure cloud engineering patterns. Incorporate container security, vulnerability scanning, and software supply chain protections. Promote secure-by-design development and platform engineering. DoD Cybersecurity and Mission Assurance Align cloud architectures with RMF, NIST SP 800-53, DISA STIGs, and applicable DoD cloud security requirements. Support Authorization to Operate (ATO) readiness, control inheritance, and continuous monitoring. Evaluate technical risks and recommend practical engineering solutions. Support security architecture considerations for applicable DoD cloud impact levels. Strengthen security posture while maintaining operational effectiveness and mission continuity. Technical Leadership Serve as a senior technical advisor to government stakeholders, program leadership, and engineering teams. Lead architectural design reviews, technical evaluations, and security engineering discussions. Develop architecture diagrams, technical decision records, and implementation guidance. Mentor engineers and coordinate across cloud, cybersecurity, networking, and infrastructure teams. Translate complex technical challenges into actionable recommendations for senior leadership. Required Qualifications Bachelor's degree in Cybersecurity, Computer Science, Engineering, Information Technology, or related discipline, with 12+ years of relevant experience; equivalent experience considered. Extensive experience designing and implementing enterprise cybersecurity architectures. Advanced hands-on expertise with at least two major cloud providers: AWS, Azure, GCP, or OCI. Strong knowledge of cloud security architecture, IAM, Zero Trust, encryption, network security, and workload protection. Experience with Infrastructure as Code, DevSecOps, CI/CD, and security automation. Understanding of containers, Kubernetes, and cloud-native application security. Experience supporting DoD, federal, or similarly regulated enterprise environments. Working knowledge of RMF, NIST security controls, and secure system authorization. Demonstrated technical leadership, problem-solving, and communication capabilities. Active DoD Secret clearance or higher. Highly Desired Qualifications Active DoD Top Secret clearance. CISSP, CCSP, CISSP-ISSAP, CISM, or comparable advanced cybersecurity certifications. AWS, Azure, GCP, or OCI cloud security certifications. Experience supporting USAF Cloud One, Cloud One Next, or comparable DoD enterprise cloud programs. Experience with DoD IL4, IL5, or IL6 environments. Expertise in multicloud architecture, Zero Trust implementation, and cloud security modernization. Experience with CNAPP, CSPM, CWPP, SIEM/SOAR, threat modeling, and vulnerability management. Experience developing security automation using Terraform, APIs, and Policy as Code. Experience advising senior government and contractor leadership on mission-critical cybersecurity engineering decisions. Compensation and Benefits AgileEdge Defense offers an annual salary range of $210,000-$230,000 , based on experience, technical qualifications, and clearance. Our comprehensive benefits package includes: Medical, dental, and vision insurance options Company-sponsored 401(k) retirement plan with employer contributions subject to plan provisions Life and accidental insurance benefits Telehealth services Paid time off and applicable federal holidays Professional development and career advancement opportunities Opportunities to support high-impact national defense technology programs Why AgileEdge Defense? AgileEdge Defense is a growing SDVOSB delivering advanced technology, cybersecurity, and mission-support capabilities to the Department of Defense. We offer experienced technical professionals the opportunity to work closely with company leadership, contribute to strategically important defense programs, and help solve some of the nation's most demanding cybersecurity challenges. We value technical excellence, accountability, innovation, and professionals who can turn complex mission requirements into practical, deployable solutions. AgileEdge Defense LLC is an Equal Opportunity Employer.
Job Description Job Description Our client is building modern financial infrastructure for businesses, combining reliable banking with industry-specific software, payments, rewards, and intelligent financial workflows. The platform powers more than $10 billion per year in business purchasing across thousands of customers. Founded in 2021, the company has grown to approximately 60 employees, reports more than $300 million in annual revenue, and has raised approximately $160 million, including a recent $100 million Series C. This is the first dedicated security engineering hire, reporting directly to the CTO and owning the security program end to end. You will build and operate the security program across infrastructure security, application security, vulnerability management, penetration testing, bug bounty operations, and engineering support for compliance. This is a hands-on generalist role for someone who wants to ship real security improvements rather than operate only through policy and checklists. What you will do: • Build and own the security engineering program across infrastructure and application layers. • Identify and prioritize security gaps, develop pragmatic remediation plans, and drive high-impact changes. • Harden AWS infrastructure, Kubernetes and EKS clusters, server configurations, networking, access controls, and cloud security posture. • Improve application security across services written in TypeScript, Go, Rust, and related technologies. • Manage recurring penetration tests and drive findings through remediation. • Operate the bug bounty program, triage vulnerability reports, and coordinate responses. • Partner with engineering on secure design, code-level fixes, deployment patterns, secrets management, and defense in depth. • Own technical work supporting SOC 2, PCI, monitoring, incident readiness, and vulnerability-management workflows. Requirements • Approximately 2 to 8 years of hands-on security engineering, software security, infrastructure security, or closely related experience. • Strong generalist ability across cloud infrastructure, application security, vulnerability management, and security operations. • Hands-on experience securing AWS and container-orchestration environments such as Kubernetes or EKS. • Experience assessing and remediating application vulnerabilities in production software. • Experience managing penetration tests, bug bounty reports, or coordinated vulnerability disclosure. • Familiarity with network security, identity and access controls, secrets management, web application defenses, and cloud posture management. • Ability to write code, automate security work, and collaborate directly with software engineers on technical fixes. • Strong risk judgment, high ownership, clear communication, and comfort operating independently. • Ability to work on-site five days per week in San Francisco or willingness to relocate. Nice to have: Experience with TypeScript, Go, Rust, CockroachDB, Kafka, Terraform, Pulumi, Cloudflare, AWS WAF, PCI, SOC 2, incident response, detection engineering, threat modeling, or secure architecture reviews. Benefits $250,000 to $350,000 base salary, based on qualifications and experience, plus competitive equity. This role is on-site five days per week in San Francisco. Existing visa transfers, including OPT and H-1B transfers, may be considered.
11/06/2026
Full time
Job Description Job Description Our client is building modern financial infrastructure for businesses, combining reliable banking with industry-specific software, payments, rewards, and intelligent financial workflows. The platform powers more than $10 billion per year in business purchasing across thousands of customers. Founded in 2021, the company has grown to approximately 60 employees, reports more than $300 million in annual revenue, and has raised approximately $160 million, including a recent $100 million Series C. This is the first dedicated security engineering hire, reporting directly to the CTO and owning the security program end to end. You will build and operate the security program across infrastructure security, application security, vulnerability management, penetration testing, bug bounty operations, and engineering support for compliance. This is a hands-on generalist role for someone who wants to ship real security improvements rather than operate only through policy and checklists. What you will do: • Build and own the security engineering program across infrastructure and application layers. • Identify and prioritize security gaps, develop pragmatic remediation plans, and drive high-impact changes. • Harden AWS infrastructure, Kubernetes and EKS clusters, server configurations, networking, access controls, and cloud security posture. • Improve application security across services written in TypeScript, Go, Rust, and related technologies. • Manage recurring penetration tests and drive findings through remediation. • Operate the bug bounty program, triage vulnerability reports, and coordinate responses. • Partner with engineering on secure design, code-level fixes, deployment patterns, secrets management, and defense in depth. • Own technical work supporting SOC 2, PCI, monitoring, incident readiness, and vulnerability-management workflows. Requirements • Approximately 2 to 8 years of hands-on security engineering, software security, infrastructure security, or closely related experience. • Strong generalist ability across cloud infrastructure, application security, vulnerability management, and security operations. • Hands-on experience securing AWS and container-orchestration environments such as Kubernetes or EKS. • Experience assessing and remediating application vulnerabilities in production software. • Experience managing penetration tests, bug bounty reports, or coordinated vulnerability disclosure. • Familiarity with network security, identity and access controls, secrets management, web application defenses, and cloud posture management. • Ability to write code, automate security work, and collaborate directly with software engineers on technical fixes. • Strong risk judgment, high ownership, clear communication, and comfort operating independently. • Ability to work on-site five days per week in San Francisco or willingness to relocate. Nice to have: Experience with TypeScript, Go, Rust, CockroachDB, Kafka, Terraform, Pulumi, Cloudflare, AWS WAF, PCI, SOC 2, incident response, detection engineering, threat modeling, or secure architecture reviews. Benefits $250,000 to $350,000 base salary, based on qualifications and experience, plus competitive equity. This role is on-site five days per week in San Francisco. Existing visa transfers, including OPT and H-1B transfers, may be considered.
Job Description Job Description To help keep everyone safe, we encourage all applicants to pay close attention to protect themselves during their job search. When applying for a position online you are at risk of being targeted by malicious actors looking for personal data. Please be aware we will only reach out via email using the domain Anything that does not match those domains should be ignored and considered a security risk. About Us Quanata is on a mission to help ensure a better world through context-based insurance solutions. We are an exceptional, customer centered team with a passion for creating innovative technologies, digital products, and brands. We blend some of the best Silicon Valley talent and cutting-edge thinking with the long-term backing of leading insurer, State Farm. Learn more about us and our work at Our Team Quanata, LLC is an insurance technology innovation company that engineers advanced risk prediction and prevention solutions, develops risk-focused acquisition capabilities, and builds/supports a full-stack, flexible, digital & increasingly AI-native insurance platform. This helps our primary clients, State Farm and HiRoad Assurance Company, adapt to evolving market needs. Quanata, LLC is wholly owned and funded by State Farm. As a company that prioritizes an inclusive and positive culture, we believe the core of our success is in hiring talented people - across disciplines - who want to help us make a quantifiable impact. The Role We're looking for an Application Security Engineer to help build secure-by-default products and services across Quanata's AI-native insurance technology platform. In this role, you'll partner closely with Product, Engineering, and Security teams to identify risks early, strengthen secure development practices, and ensure our applications are resilient, scalable, and compliant. You'll play a key role in embedding security throughout the software development lifecycle while helping teams move quickly and safely. Your Day-to-Day Partner with Product and Engineering teams to integrate security into application design and development Lead threat modeling exercises and identify practical security solutions for complex systems Conduct secure code reviews, application security assessments, and vulnerability analysis Develop and implement automated security guardrails across the SDLC Investigate, prioritize, and drive remediation of application security findings Promote secure coding practices through training, coaching, and awareness initiatives Collaborate with Security, Privacy, and Business Assurance teams to support compliance and risk management objectives Create and maintain security standards, procedures, and best practices that scale across teams About You Associate's degree or equivalent experience required; Bachelor's degree preferred 4-6+ years of experience in software engineering, including at least 2 years focused on application security Experience partnering directly with software development teams to improve application security Knowledge of secure-by-design principles and modern application security practices Familiarity with OWASP Top 10, ASVS, MASVS, and common application security frameworks Experience with threat modeling methodologies such as STRIDE, PASTA, or similar approaches Working knowledge of cloud platforms and modern application architectures Proficiency in at least one programming language and its security ecosystem Strong communication skills and the ability to influence technical and non-technical stakeholders Comfortable operating in a fast-paced environment with shifting priorities Bonus Points Security certifications such as CSSLP, GWEB, OSWE, or similar Experience working in insurance, financial services, healthcare, or other regulated industries Advanced knowledge of cloud security and application security architecture Experience with mobile application security, QA testing, or penetration testing Familiarity with AI technologies, LLM security, or prompt engineering Experience building scripts or automations to streamline security processes Active involvement in the security community through conferences, mentoring, presentations, publications, or open-source contributions Salary: $175,000 to $215,000 Please note that the final salary offered will be determined based on the selected candidate's skills, and experience, as well as the internal salary structure at Quanata. Our aim is to offer a competitive and equitable compensation package that reflects the candidate's expertise and contributions to our organization. Additional Details: Benefits : We provide a wide variety of health, wellness and other benefits.These include medical, dental, vision, life insurance and supplemental income plans for you and your dependents, a Headspace app subscription, monthly wellness allowance and a 401(k) Plan with a company match. Work from Home Equipment : Given our virtual environment- in order to set you up for success at home, a one-time payment of $2K will be provided to cover the purchase of in-home office equipment and furniture at your discretion. Also, our teams work with MacBook Pros, which we will deliver to you fully provisioned prior to your first day. Paid Time Off: All employees accrue four weeks of PTO in their first year of employment. New parents receive twelve weeks of fully paid parental leave which may be taken within one year after the birth and/or adoption of a child. The twelve weeks is applicable to both birthing and non-birthing parent. Personal and Professional Development: We're committed to investing in and helping our people grow personally and professionally. All employees receive up to $5000 each year for professional learning, continuing education and career development. All team members also receive LinkedIn Learning subscriptions and access to multiple different coaching opportunities through BetterUp. Location : We are a remote-first company for most positions so you may work from anywhere you like in the U.S, excluding U.S. territories. For most positions, occasional travel may be requested or encouraged but is not required . Some positions might require travel per the job description provided to the employee. Employees based in the San Francisco Bay Area or in Providence, Rhode Island may commute to one of our local offices as desired. Hours : We maintain core meeting hours from 9AM - 2PM Pacific time for collaborating with team members across all time zones. Quanata, LLC is an equal opportunity workplace. We are committed to equal employment opportunities regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status. Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records. If you are a San Francisco resident, please read the City and County of San Francisco's Fair Chance Ordinance notice. : - 12/FCO%20poster2020_0.pdf This role is employed by Quanata, LLC which is a separate company in the State Farm family of companies. If you require a reasonable accommodation, please reach out to your Talent Acquisition Partner for assistance.
11/06/2026
Full time
Job Description Job Description To help keep everyone safe, we encourage all applicants to pay close attention to protect themselves during their job search. When applying for a position online you are at risk of being targeted by malicious actors looking for personal data. Please be aware we will only reach out via email using the domain Anything that does not match those domains should be ignored and considered a security risk. About Us Quanata is on a mission to help ensure a better world through context-based insurance solutions. We are an exceptional, customer centered team with a passion for creating innovative technologies, digital products, and brands. We blend some of the best Silicon Valley talent and cutting-edge thinking with the long-term backing of leading insurer, State Farm. Learn more about us and our work at Our Team Quanata, LLC is an insurance technology innovation company that engineers advanced risk prediction and prevention solutions, develops risk-focused acquisition capabilities, and builds/supports a full-stack, flexible, digital & increasingly AI-native insurance platform. This helps our primary clients, State Farm and HiRoad Assurance Company, adapt to evolving market needs. Quanata, LLC is wholly owned and funded by State Farm. As a company that prioritizes an inclusive and positive culture, we believe the core of our success is in hiring talented people - across disciplines - who want to help us make a quantifiable impact. The Role We're looking for an Application Security Engineer to help build secure-by-default products and services across Quanata's AI-native insurance technology platform. In this role, you'll partner closely with Product, Engineering, and Security teams to identify risks early, strengthen secure development practices, and ensure our applications are resilient, scalable, and compliant. You'll play a key role in embedding security throughout the software development lifecycle while helping teams move quickly and safely. Your Day-to-Day Partner with Product and Engineering teams to integrate security into application design and development Lead threat modeling exercises and identify practical security solutions for complex systems Conduct secure code reviews, application security assessments, and vulnerability analysis Develop and implement automated security guardrails across the SDLC Investigate, prioritize, and drive remediation of application security findings Promote secure coding practices through training, coaching, and awareness initiatives Collaborate with Security, Privacy, and Business Assurance teams to support compliance and risk management objectives Create and maintain security standards, procedures, and best practices that scale across teams About You Associate's degree or equivalent experience required; Bachelor's degree preferred 4-6+ years of experience in software engineering, including at least 2 years focused on application security Experience partnering directly with software development teams to improve application security Knowledge of secure-by-design principles and modern application security practices Familiarity with OWASP Top 10, ASVS, MASVS, and common application security frameworks Experience with threat modeling methodologies such as STRIDE, PASTA, or similar approaches Working knowledge of cloud platforms and modern application architectures Proficiency in at least one programming language and its security ecosystem Strong communication skills and the ability to influence technical and non-technical stakeholders Comfortable operating in a fast-paced environment with shifting priorities Bonus Points Security certifications such as CSSLP, GWEB, OSWE, or similar Experience working in insurance, financial services, healthcare, or other regulated industries Advanced knowledge of cloud security and application security architecture Experience with mobile application security, QA testing, or penetration testing Familiarity with AI technologies, LLM security, or prompt engineering Experience building scripts or automations to streamline security processes Active involvement in the security community through conferences, mentoring, presentations, publications, or open-source contributions Salary: $175,000 to $215,000 Please note that the final salary offered will be determined based on the selected candidate's skills, and experience, as well as the internal salary structure at Quanata. Our aim is to offer a competitive and equitable compensation package that reflects the candidate's expertise and contributions to our organization. Additional Details: Benefits : We provide a wide variety of health, wellness and other benefits.These include medical, dental, vision, life insurance and supplemental income plans for you and your dependents, a Headspace app subscription, monthly wellness allowance and a 401(k) Plan with a company match. Work from Home Equipment : Given our virtual environment- in order to set you up for success at home, a one-time payment of $2K will be provided to cover the purchase of in-home office equipment and furniture at your discretion. Also, our teams work with MacBook Pros, which we will deliver to you fully provisioned prior to your first day. Paid Time Off: All employees accrue four weeks of PTO in their first year of employment. New parents receive twelve weeks of fully paid parental leave which may be taken within one year after the birth and/or adoption of a child. The twelve weeks is applicable to both birthing and non-birthing parent. Personal and Professional Development: We're committed to investing in and helping our people grow personally and professionally. All employees receive up to $5000 each year for professional learning, continuing education and career development. All team members also receive LinkedIn Learning subscriptions and access to multiple different coaching opportunities through BetterUp. Location : We are a remote-first company for most positions so you may work from anywhere you like in the U.S, excluding U.S. territories. For most positions, occasional travel may be requested or encouraged but is not required . Some positions might require travel per the job description provided to the employee. Employees based in the San Francisco Bay Area or in Providence, Rhode Island may commute to one of our local offices as desired. Hours : We maintain core meeting hours from 9AM - 2PM Pacific time for collaborating with team members across all time zones. Quanata, LLC is an equal opportunity workplace. We are committed to equal employment opportunities regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status. Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records. If you are a San Francisco resident, please read the City and County of San Francisco's Fair Chance Ordinance notice. : - 12/FCO%20poster2020_0.pdf This role is employed by Quanata, LLC which is a separate company in the State Farm family of companies. If you require a reasonable accommodation, please reach out to your Talent Acquisition Partner for assistance.
Gauss Management Research & Engineering
Ridgecrest, California
Job Description Job Description Description: JOB SUMMARY The Chief Engineer serves as the senior technical authority for all engineering, software development, systems integration, and test execution performed under a NAVAIR contract. The position provides technical leadership across aircraft weapon system integration work for NAWCWD aircraft IPTs - F/A-18, EA-18G, AV-8B, AH-1, F-35, Unmanned Systems, and successor platforms - spanning weapons integration, avionics, sensors, targeting systems, system hardware and software, test laboratory / simulator / trainer operation, aircraft test instrumentation, and telemetry. The Chief Engineer is the technical peer to the Program Manager: the PM owns contract performance; the Chief Engineer owns engineering outcomes. This role is Direct Key Personnel - billable to the contract at the Senior labor category rate for General and Operations Manager. ROLES AND RESPONSIBILITIES Technical Leadership & Systems Integration: Serve as the senior technical authority for all work performed under the contract; approve technical approach, engineering deliverables, and integration methodology across all task orders. Direct weapons, avionics, sensors, targeting systems, system hardware, and software integration for NAWCWD aircraft IPTs and foreign military sales variants. Own the engineering rigor of system analysis, research, development, engineering, testing, test-equipment design/fabrication/maintenance, mission simulation, and interoperability assurance across supported platforms. Direct investigation, analysis, and documentation of new or modified weapons, sensors, targeting systems, aircraft computers, avionics systems, database architectures, trainers, and related systems - including electronic warfare systems - being considered for integration into supported aircraft. Software Engineering & Development: Direct software engineering and development for aircraft computers, avionics, sensors, targeting systems, weapons systems, test laboratories, simulators, and mission/system support equipment. Own Software Quality Assurance (SQA), Software Configuration Management (SCM), and Verification and Validation (V&V) processes program wide. Approve the Software Development Plan (CDRL A00D) and all task-order-level software engineering approaches; enforce compliance with agile principles and applications where adopted by IPT direction. Test, Laboratory & Instrumentation: Direct operation, maintenance, repair, and upgrade of test laboratory, simulator, and trainer equipment per task-order-level requirements and specifications. Own the technical approach to aircraft test instrumentation, telemetry systems design, development, installation, maintenance, service, setup, and operation including ground-based telemetry systems. Approve tradeoff studies for OEM versus third-party maintenance of test laboratory, simulator, and trainer equipment; direct preparation of maintenance procedures and manuals (CDRLs A00F and A00V). Ensure legacy computer system support and micro-computer systems integration at NAWCWD comply with RDT&E domain board approvals and Navy RDT&E security policies. Cybersecurity & Engineering Compliance: Direct the engineering organization's compliance with the Cybersecurity Strategy, Security Plan, and Risk Management Framework for DoD IT (DoDI 8510.01). Ensure hardware, firmware, software, documentation, and IT services delivered under the contract comply with DoDI 8500.01, DoDI 8510.01, CNSSI 1253, DoDD 8140.01, and DoD 8570.01-M as applicable. Oversee criticality analysis, threat assessment, and vulnerability assessments for all task orders involving acquisition program artifacts. Direct the qualification, certification, and sustainment of technical staff against DoD 8140.01 Cyberspace Workforce Framework work roles. Engineering Workforce & Capability Development Direct the technical career development framework including certification paths, professional development, conference participation, and professional association membership. Set engineering discipline technical standards and enforce them through peer review, design reviews, and independent technical assessments. Lead engineering recruitment evaluation - final technical authority on engineering hires across all disciplines. Provide guidance and direction to lower-level technical and engineering managers; provide technical support on advanced engineering issues including system architecture decisions, interface control, and cross-platform interoperability. Customer Technical Relationship Represent the prime contractor at the Chief Engineer / Deputy Chief Engineer level to NAWCWD aircraft IPT leadership and Program Support Offices. Participate in Integrated Product Team technical working groups, System Design Reviews, Critical Design Reviews, Test Readiness Reviews, and Flight Readiness Reviews as required. Own the technical content and technical accuracy of all program reviews, CDRL technical deliverables, and customer-facing engineering reports. WHY WORK FOR GMRE? GMRE is a small veteran-owned company who cares about our employees. We offer health, dental, and vision insurance, 401(k), vacation, Paid Time Off (PTO), or Paid Sick Leave (PSL) based on state laws, paid holidays, and life insurance to all permanent full-time employees. GMRE's mission is to provide high-quality engineering and technical services to help our customers grow and succeed. (Relocation assistance may be available) GMRE is an equal opportunity employer. GMRE is committed to making employment decisions based on valid requirements, without regard to age 40 and over, color, disability, gender identity, genetic information, military or veteran status, national origin, race, religion, sex, sexual orientation or any other applicable status protected by state or local laws. This job description is not designed to cover or contain a comprehensive listing of activities, duties, or responsibilities that are required of the employee. Duties, responsibilities, and activities may change, or new ones may be assigned at any time with or without notice. Requirements: REQUIRED SKILLS/ABILITIES Meeting the SOW minimum qualifies a candidate for the role. However, the candidates who will be competitive against incumbent alternatives have most or all of the following: Preferred Qualifications Master's degree in Aerospace Engineering, Electrical Engineering, Mechanical Engineering, Systems Engineering, Software Engineering, Computer Engineering, or closely related technical discipline. Chief Engineer, Senior Systems Engineer, or equivalent engineering leadership role on an aircraft weapons system integration contract at NAWCWD, NAVAIR, or a Department of the Navy laboratory. Direct technical experience on one or more supported platforms - F/A-18, EA-18G, AV-8B, AH-1, F-35, or Navy Unmanned Systems - or on comparable aircraft weapon systems integration at the OEM or government laboratory level. Professional Engineer (PE) license, INCOSE Certified Systems Engineering Professional (CSEP or ESEP), or equivalent senior-engineer credential. Documented leadership of full systems integration lifecycle - requirements definition through verification, validation, and Integrated Warfighting Capability delivery. Experience with Software Development Plans, SQA, SCM, V&V processes, and agile software engineering practice on DoD weapons or avionics programs. Experience with aircraft test instrumentation, telemetry systems, or ground-based telemetry at a Major Range and Test Facility Base (MRTFB). Active TS/SCI clearance; prior SAP access on aircraft weapons or EW programs. Knowledge, Skills & Abilities Deep technical command of weapons-platform systems integration - hardware, software, firmware, interfaces, test equipment, and mission simulation. Command of DoD acquisition technical review and milestone processes (SDR, PDR, CDR, TRR, FRR) and the artifacts required at each (ICD, CDD, CPD, SEP, TEMP, RMP). Fluency with DoD cybersecurity frameworks - DoDI 8500.01, 8510.01, 8140.01, RMF, CNSSI 1253 - as applied to weapons system engineering deliverables. Ability to lead technical working groups across prime, subcontractor, OEM, and government engineering staff - producing technically sound, DCAA-defensible engineering outcomes. Technical writing and presentation at the CDR and FRR level; ability to present to Flag Officer, PEO, and MDA audiences. EDUCATION AND EXPERIENCE Minimum Qualifications: Education MS/MA Degree in a relevant technical field. Allowable Substitution: a BS or BA degree and an additional four (4) years of experience. Experience Minimum 20 years of combined aviation and management experience. At least 3 years of experience providing guidance and direction to lower-level technical/engineering managers, and providing technical support on advanced engineering issues. SECURITY CLEARANCE AND OTHER REQUIREMENTS Active DoD Secret clearance required at hire; Top Secret/SCI required within 90 days of start. SAP access eligibility per task order - the contract supports program areas where the highest clearance level is Special Access Program. DoD 8140.01 Cyberspace Workforce qualification at the Chief Engineer / Senior Technical Lead work role level. . click apply for full job details
11/06/2026
Full time
Job Description Job Description Description: JOB SUMMARY The Chief Engineer serves as the senior technical authority for all engineering, software development, systems integration, and test execution performed under a NAVAIR contract. The position provides technical leadership across aircraft weapon system integration work for NAWCWD aircraft IPTs - F/A-18, EA-18G, AV-8B, AH-1, F-35, Unmanned Systems, and successor platforms - spanning weapons integration, avionics, sensors, targeting systems, system hardware and software, test laboratory / simulator / trainer operation, aircraft test instrumentation, and telemetry. The Chief Engineer is the technical peer to the Program Manager: the PM owns contract performance; the Chief Engineer owns engineering outcomes. This role is Direct Key Personnel - billable to the contract at the Senior labor category rate for General and Operations Manager. ROLES AND RESPONSIBILITIES Technical Leadership & Systems Integration: Serve as the senior technical authority for all work performed under the contract; approve technical approach, engineering deliverables, and integration methodology across all task orders. Direct weapons, avionics, sensors, targeting systems, system hardware, and software integration for NAWCWD aircraft IPTs and foreign military sales variants. Own the engineering rigor of system analysis, research, development, engineering, testing, test-equipment design/fabrication/maintenance, mission simulation, and interoperability assurance across supported platforms. Direct investigation, analysis, and documentation of new or modified weapons, sensors, targeting systems, aircraft computers, avionics systems, database architectures, trainers, and related systems - including electronic warfare systems - being considered for integration into supported aircraft. Software Engineering & Development: Direct software engineering and development for aircraft computers, avionics, sensors, targeting systems, weapons systems, test laboratories, simulators, and mission/system support equipment. Own Software Quality Assurance (SQA), Software Configuration Management (SCM), and Verification and Validation (V&V) processes program wide. Approve the Software Development Plan (CDRL A00D) and all task-order-level software engineering approaches; enforce compliance with agile principles and applications where adopted by IPT direction. Test, Laboratory & Instrumentation: Direct operation, maintenance, repair, and upgrade of test laboratory, simulator, and trainer equipment per task-order-level requirements and specifications. Own the technical approach to aircraft test instrumentation, telemetry systems design, development, installation, maintenance, service, setup, and operation including ground-based telemetry systems. Approve tradeoff studies for OEM versus third-party maintenance of test laboratory, simulator, and trainer equipment; direct preparation of maintenance procedures and manuals (CDRLs A00F and A00V). Ensure legacy computer system support and micro-computer systems integration at NAWCWD comply with RDT&E domain board approvals and Navy RDT&E security policies. Cybersecurity & Engineering Compliance: Direct the engineering organization's compliance with the Cybersecurity Strategy, Security Plan, and Risk Management Framework for DoD IT (DoDI 8510.01). Ensure hardware, firmware, software, documentation, and IT services delivered under the contract comply with DoDI 8500.01, DoDI 8510.01, CNSSI 1253, DoDD 8140.01, and DoD 8570.01-M as applicable. Oversee criticality analysis, threat assessment, and vulnerability assessments for all task orders involving acquisition program artifacts. Direct the qualification, certification, and sustainment of technical staff against DoD 8140.01 Cyberspace Workforce Framework work roles. Engineering Workforce & Capability Development Direct the technical career development framework including certification paths, professional development, conference participation, and professional association membership. Set engineering discipline technical standards and enforce them through peer review, design reviews, and independent technical assessments. Lead engineering recruitment evaluation - final technical authority on engineering hires across all disciplines. Provide guidance and direction to lower-level technical and engineering managers; provide technical support on advanced engineering issues including system architecture decisions, interface control, and cross-platform interoperability. Customer Technical Relationship Represent the prime contractor at the Chief Engineer / Deputy Chief Engineer level to NAWCWD aircraft IPT leadership and Program Support Offices. Participate in Integrated Product Team technical working groups, System Design Reviews, Critical Design Reviews, Test Readiness Reviews, and Flight Readiness Reviews as required. Own the technical content and technical accuracy of all program reviews, CDRL technical deliverables, and customer-facing engineering reports. WHY WORK FOR GMRE? GMRE is a small veteran-owned company who cares about our employees. We offer health, dental, and vision insurance, 401(k), vacation, Paid Time Off (PTO), or Paid Sick Leave (PSL) based on state laws, paid holidays, and life insurance to all permanent full-time employees. GMRE's mission is to provide high-quality engineering and technical services to help our customers grow and succeed. (Relocation assistance may be available) GMRE is an equal opportunity employer. GMRE is committed to making employment decisions based on valid requirements, without regard to age 40 and over, color, disability, gender identity, genetic information, military or veteran status, national origin, race, religion, sex, sexual orientation or any other applicable status protected by state or local laws. This job description is not designed to cover or contain a comprehensive listing of activities, duties, or responsibilities that are required of the employee. Duties, responsibilities, and activities may change, or new ones may be assigned at any time with or without notice. Requirements: REQUIRED SKILLS/ABILITIES Meeting the SOW minimum qualifies a candidate for the role. However, the candidates who will be competitive against incumbent alternatives have most or all of the following: Preferred Qualifications Master's degree in Aerospace Engineering, Electrical Engineering, Mechanical Engineering, Systems Engineering, Software Engineering, Computer Engineering, or closely related technical discipline. Chief Engineer, Senior Systems Engineer, or equivalent engineering leadership role on an aircraft weapons system integration contract at NAWCWD, NAVAIR, or a Department of the Navy laboratory. Direct technical experience on one or more supported platforms - F/A-18, EA-18G, AV-8B, AH-1, F-35, or Navy Unmanned Systems - or on comparable aircraft weapon systems integration at the OEM or government laboratory level. Professional Engineer (PE) license, INCOSE Certified Systems Engineering Professional (CSEP or ESEP), or equivalent senior-engineer credential. Documented leadership of full systems integration lifecycle - requirements definition through verification, validation, and Integrated Warfighting Capability delivery. Experience with Software Development Plans, SQA, SCM, V&V processes, and agile software engineering practice on DoD weapons or avionics programs. Experience with aircraft test instrumentation, telemetry systems, or ground-based telemetry at a Major Range and Test Facility Base (MRTFB). Active TS/SCI clearance; prior SAP access on aircraft weapons or EW programs. Knowledge, Skills & Abilities Deep technical command of weapons-platform systems integration - hardware, software, firmware, interfaces, test equipment, and mission simulation. Command of DoD acquisition technical review and milestone processes (SDR, PDR, CDR, TRR, FRR) and the artifacts required at each (ICD, CDD, CPD, SEP, TEMP, RMP). Fluency with DoD cybersecurity frameworks - DoDI 8500.01, 8510.01, 8140.01, RMF, CNSSI 1253 - as applied to weapons system engineering deliverables. Ability to lead technical working groups across prime, subcontractor, OEM, and government engineering staff - producing technically sound, DCAA-defensible engineering outcomes. Technical writing and presentation at the CDR and FRR level; ability to present to Flag Officer, PEO, and MDA audiences. EDUCATION AND EXPERIENCE Minimum Qualifications: Education MS/MA Degree in a relevant technical field. Allowable Substitution: a BS or BA degree and an additional four (4) years of experience. Experience Minimum 20 years of combined aviation and management experience. At least 3 years of experience providing guidance and direction to lower-level technical/engineering managers, and providing technical support on advanced engineering issues. SECURITY CLEARANCE AND OTHER REQUIREMENTS Active DoD Secret clearance required at hire; Top Secret/SCI required within 90 days of start. SAP access eligibility per task order - the contract supports program areas where the highest clearance level is Special Access Program. DoD 8140.01 Cyberspace Workforce qualification at the Chief Engineer / Senior Technical Lead work role level. . click apply for full job details
Job Description Job Description RiVidium Inc. is seeking a Security Control Assessor who conducts independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST 800-37). TASKS: Manage and approve Accreditation Packages (e.g., ISO/IEC 15026-2). Plan and conduct security authorization reviews and assurance case development for initial installation of systems and networks. Review authorization and assurance documents to confirm that the level of risk is within acceptable limits for each software application, system, and network. Verify that application software/network/system security postures are implemented as stated, document deviations, and recommend required actions to correct those deviations. Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centers). Establish acceptable limits for the software application, network, or system. Manage Accreditation Packages (e.g., ISO/IEC 15026-2). Perform security reviews, identify gaps in security architecture, and develop a security risk management plan. Perform security reviews and identify security gaps in security architecture resulting in recommendations for inclusion in the risk mitigation strategy. Perform risk analysis (e.g., threat, vulnerability, and probability of occurrence) whenever an application or system undergoes a major change. Provide input to the Risk Management Framework process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials). Verify and update security documentation reflecting the application/system security design features. Participate in Risk Governance process to provide security risks, mitigations, and input on other technical risk. Ensure that plans of actions and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, etc. Assure successful implementation and functionality of security requirements and appropriate information technology (IT) policies and procedures that are consistent with the organization's mission and goals. Define and document how the implementation of a new system or new interfaces between systems impacts the security posture of the current environment. Ensure that security design and cybersecurity development activities are properly documented (providing a functional description of security implementation) and updated as necessary. Support necessary compliance activities (e.g., ensure that system security configuration guidelines are followed, compliance monitoring occurs). Ensure that all acquisitions, procurements, and outsourcing efforts address information security requirements consistent with organization goals. Assess the effectiveness of security controls. Assess all the configuration management (change configuration/release management) processes. ABILITIES: Ability to identify systemic security issues based on the analysis of vulnerability and configuration data. Ability to answer questions in a clear and concise manner. Ability to ask clarifying questions. Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means. Ability to communicate effectively when writing.A0015: Ability to conduct vulnerability scans and recognize vulnerabilities in security systems.A0016: Ability to facilitate small group discussions.A0018: Ability to prepare and present briefings. Ability to produce technical documentation. Ability to design valid and reliable assessments. Ability to analyze test data. Ability to collect, verify, and validate test data. Ability to dissect a problem and examine the interrelationships between data that may appear unrelated. Ability to identify basic common coding flaws at a high level. Ability to translate data and test results into evaluative conclusions. Ability to ensure security practices are followed throughout the acquisition process. Ability to apply collaborative skills and strategies. Ability to apply critical reading/thinking skills. Ability to effectively collaborate via virtual teams. Ability to evaluate information for reliability, validity, and relevance. Ability to evaluate, analyze, and synthesize large quantities of data (which may be fragmented and contradictory) into high quality, fused targeting/intelligence products. Requirements: Bachelor degree or higher from an accredited college or university. Prefer an accredited Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, or Computer Engineering degree; or a degree in a Mathematics or Engineering field. Certifications: IAT Level 2 cert Clearance- TS/SCI
11/06/2026
Full time
Job Description Job Description RiVidium Inc. is seeking a Security Control Assessor who conducts independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST 800-37). TASKS: Manage and approve Accreditation Packages (e.g., ISO/IEC 15026-2). Plan and conduct security authorization reviews and assurance case development for initial installation of systems and networks. Review authorization and assurance documents to confirm that the level of risk is within acceptable limits for each software application, system, and network. Verify that application software/network/system security postures are implemented as stated, document deviations, and recommend required actions to correct those deviations. Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centers). Establish acceptable limits for the software application, network, or system. Manage Accreditation Packages (e.g., ISO/IEC 15026-2). Perform security reviews, identify gaps in security architecture, and develop a security risk management plan. Perform security reviews and identify security gaps in security architecture resulting in recommendations for inclusion in the risk mitigation strategy. Perform risk analysis (e.g., threat, vulnerability, and probability of occurrence) whenever an application or system undergoes a major change. Provide input to the Risk Management Framework process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials). Verify and update security documentation reflecting the application/system security design features. Participate in Risk Governance process to provide security risks, mitigations, and input on other technical risk. Ensure that plans of actions and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, etc. Assure successful implementation and functionality of security requirements and appropriate information technology (IT) policies and procedures that are consistent with the organization's mission and goals. Define and document how the implementation of a new system or new interfaces between systems impacts the security posture of the current environment. Ensure that security design and cybersecurity development activities are properly documented (providing a functional description of security implementation) and updated as necessary. Support necessary compliance activities (e.g., ensure that system security configuration guidelines are followed, compliance monitoring occurs). Ensure that all acquisitions, procurements, and outsourcing efforts address information security requirements consistent with organization goals. Assess the effectiveness of security controls. Assess all the configuration management (change configuration/release management) processes. ABILITIES: Ability to identify systemic security issues based on the analysis of vulnerability and configuration data. Ability to answer questions in a clear and concise manner. Ability to ask clarifying questions. Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means. Ability to communicate effectively when writing.A0015: Ability to conduct vulnerability scans and recognize vulnerabilities in security systems.A0016: Ability to facilitate small group discussions.A0018: Ability to prepare and present briefings. Ability to produce technical documentation. Ability to design valid and reliable assessments. Ability to analyze test data. Ability to collect, verify, and validate test data. Ability to dissect a problem and examine the interrelationships between data that may appear unrelated. Ability to identify basic common coding flaws at a high level. Ability to translate data and test results into evaluative conclusions. Ability to ensure security practices are followed throughout the acquisition process. Ability to apply collaborative skills and strategies. Ability to apply critical reading/thinking skills. Ability to effectively collaborate via virtual teams. Ability to evaluate information for reliability, validity, and relevance. Ability to evaluate, analyze, and synthesize large quantities of data (which may be fragmented and contradictory) into high quality, fused targeting/intelligence products. Requirements: Bachelor degree or higher from an accredited college or university. Prefer an accredited Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, or Computer Engineering degree; or a degree in a Mathematics or Engineering field. Certifications: IAT Level 2 cert Clearance- TS/SCI
Job Description Job Description You will be the most senior hands-on application security engineer at Cleo, owning both how security is built into our products from design through release and the security posture of the products we ship, both on-premise and SaaS, as our customers experience them. This is a Staff-level individual contributor role with real program ownership: you set the standards, build the guardrails, and work directly with engineers in the code. You report to the CISO and partner daily with Engineering, and our Cloud Security team. You are not a one-person department: security engineers and consulting partners execute under your direction. Your job is to set direction, make the hard technical calls, and build leverage through automation and partners rather than carry every task yourself. Essential Duties & Responsibilities Secure development lifecycle and guardrails Own and mature Cleo's SSDLC: security requirements, threat modeling, and design reviews for high-risk product changes, APIs, and integrations. Run and tune SAST, SCA, secrets detection, container, and IaC scanning. Build reusable secure patterns, reference implementations, and policy-as-code controls that make the secure path the default path. Own developer security enablement: Security Champions meeting, deliver the engineering security training campaigns, grow a named champion in every squad, and give developers practical remediation guidance, office hours, and self-service security capabilities. Product vulnerability management Run risk-based triage, remediation, and verification for application and product vulnerabilities, including remediation SLAs, escalation, and exceptions. Reproduce externally reported vulnerabilities against running product instances and validate patches before release. Own the penetration testing program: scope and coordinate third-party engagements, perform targeted testing yourself, and validate findings through retesting. Run our Vulnerability Disclosure Program, including researcher communications and coordinated disclosure. Coordinate the CVE lifecycle for Cleo products and support product-security incident response. Own the application and product-security controls in Cleo's NIST CSF 2.0 program: track maturity, close gaps, and produce the evidence our audits rely on. Product security Own the security posture of the products Cleo ships, across SaaS and customer-hosted deployment models: secure defaults, authentication and session controls, RBAC and tenant isolation, admin data access, security-relevant configuration, and hardening guidance for customers. Own the Product Security Roadmap: partner with Product Management, the CTO, and Architecture to get security features prioritized and shipped, including SSO/SAML upgrades, the in-app RBAC redesign, endpoint-level access control, and customer-requested controls, and represent security in RTE Sync and Boundary Review. Be the technical owner for customer-facing product security: triage customer vulnerability-scan findings and penetration-test reports against Cleo products, answer security RFIs and enhancement requests, and author customer-facing advisories, security release notes, and hardening documentation. AI Fluency Competencies Own threat modeling and security review for LLM-enabled product features, AI agents, and AI-assisted development workflows. Build controls and secure patterns for prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risk. Apply and operationalize the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework across product and engineering. Prerequisites 6+ years in application security, product security, or secure software engineering, including experience building or maturing an AppSec program across multiple engineering teams. Strong object-oriented developer: Strong proficiency in an object-oriented programming language is required, with Java preferred given Cleo's core products are Java-based. You should be able to read, debug, and write production-quality code and be comfortable working across languages such as TypeScript, Python, or Go. Deep knowledge of application attack surfaces: authentication, authorization, API security, business-logic flaws, and modern service architectures. Hands-on experience integrating and tuning SAST, SCA, and secrets scanning in GitHub and CI/CD pipelines. Hands-on exploit reproduction and patch validation: you can take a researcher's report of a pre-authentication vulnerability, reproduce it against a running Java web application, confirm the fix, and write up what the researcher and the customer each need to hear. Coordinated disclosure experience with external security researchers and customers, including holding an embargo timeline and driving a CVE to publication. Product security experience on shipped software with an installed base: secure defaults and hardening guidance, customer-facing advisories and security release notes, and turning a customer's scan report or RFI into a fix-or-explain response. Experience running threat modeling, design reviews, and manual security testing, and working directly with developers through remediation. Clear communicator who can turn technical risk into engineering guidance for both developers and executives, and who can hold a release-gating decision with Engineering leadership when the risk warrants it. Nice to Have Securing LLM applications, AI agents, or AI-assisted development tools. SBOM (CycloneDX/SPDX), VEX, artifact signing, and SLSA. AWS, Kubernetes/EKS, Terraform, Jenkins. Snyk, GitHub Advanced Security, Semgrep, Burp Suite. NIST CSF 2.0, OWASP SAMM/ASVS, NIST SSDF; supporting SOC 2 or ISO 27001 audits. CSSLP, OSWE, GWAPT, AWS Security, or comparable certifications.
11/06/2026
Full time
Job Description Job Description You will be the most senior hands-on application security engineer at Cleo, owning both how security is built into our products from design through release and the security posture of the products we ship, both on-premise and SaaS, as our customers experience them. This is a Staff-level individual contributor role with real program ownership: you set the standards, build the guardrails, and work directly with engineers in the code. You report to the CISO and partner daily with Engineering, and our Cloud Security team. You are not a one-person department: security engineers and consulting partners execute under your direction. Your job is to set direction, make the hard technical calls, and build leverage through automation and partners rather than carry every task yourself. Essential Duties & Responsibilities Secure development lifecycle and guardrails Own and mature Cleo's SSDLC: security requirements, threat modeling, and design reviews for high-risk product changes, APIs, and integrations. Run and tune SAST, SCA, secrets detection, container, and IaC scanning. Build reusable secure patterns, reference implementations, and policy-as-code controls that make the secure path the default path. Own developer security enablement: Security Champions meeting, deliver the engineering security training campaigns, grow a named champion in every squad, and give developers practical remediation guidance, office hours, and self-service security capabilities. Product vulnerability management Run risk-based triage, remediation, and verification for application and product vulnerabilities, including remediation SLAs, escalation, and exceptions. Reproduce externally reported vulnerabilities against running product instances and validate patches before release. Own the penetration testing program: scope and coordinate third-party engagements, perform targeted testing yourself, and validate findings through retesting. Run our Vulnerability Disclosure Program, including researcher communications and coordinated disclosure. Coordinate the CVE lifecycle for Cleo products and support product-security incident response. Own the application and product-security controls in Cleo's NIST CSF 2.0 program: track maturity, close gaps, and produce the evidence our audits rely on. Product security Own the security posture of the products Cleo ships, across SaaS and customer-hosted deployment models: secure defaults, authentication and session controls, RBAC and tenant isolation, admin data access, security-relevant configuration, and hardening guidance for customers. Own the Product Security Roadmap: partner with Product Management, the CTO, and Architecture to get security features prioritized and shipped, including SSO/SAML upgrades, the in-app RBAC redesign, endpoint-level access control, and customer-requested controls, and represent security in RTE Sync and Boundary Review. Be the technical owner for customer-facing product security: triage customer vulnerability-scan findings and penetration-test reports against Cleo products, answer security RFIs and enhancement requests, and author customer-facing advisories, security release notes, and hardening documentation. AI Fluency Competencies Own threat modeling and security review for LLM-enabled product features, AI agents, and AI-assisted development workflows. Build controls and secure patterns for prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risk. Apply and operationalize the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework across product and engineering. Prerequisites 6+ years in application security, product security, or secure software engineering, including experience building or maturing an AppSec program across multiple engineering teams. Strong object-oriented developer: Strong proficiency in an object-oriented programming language is required, with Java preferred given Cleo's core products are Java-based. You should be able to read, debug, and write production-quality code and be comfortable working across languages such as TypeScript, Python, or Go. Deep knowledge of application attack surfaces: authentication, authorization, API security, business-logic flaws, and modern service architectures. Hands-on experience integrating and tuning SAST, SCA, and secrets scanning in GitHub and CI/CD pipelines. Hands-on exploit reproduction and patch validation: you can take a researcher's report of a pre-authentication vulnerability, reproduce it against a running Java web application, confirm the fix, and write up what the researcher and the customer each need to hear. Coordinated disclosure experience with external security researchers and customers, including holding an embargo timeline and driving a CVE to publication. Product security experience on shipped software with an installed base: secure defaults and hardening guidance, customer-facing advisories and security release notes, and turning a customer's scan report or RFI into a fix-or-explain response. Experience running threat modeling, design reviews, and manual security testing, and working directly with developers through remediation. Clear communicator who can turn technical risk into engineering guidance for both developers and executives, and who can hold a release-gating decision with Engineering leadership when the risk warrants it. Nice to Have Securing LLM applications, AI agents, or AI-assisted development tools. SBOM (CycloneDX/SPDX), VEX, artifact signing, and SLSA. AWS, Kubernetes/EKS, Terraform, Jenkins. Snyk, GitHub Advanced Security, Semgrep, Burp Suite. NIST CSF 2.0, OWASP SAMM/ASVS, NIST SSDF; supporting SOC 2 or ISO 27001 audits. CSSLP, OSWE, GWAPT, AWS Security, or comparable certifications.
Job Description Job Description We are looking for an experienced Application Security Engineer to take a hands-on role in improving security across a broad portfolio of web applications and APIs. This person will partner closely with software engineering teams to identify security weaknesses, determine which issues present meaningful risk, and drive remediation through completion. The role requires someone who can go beyond automated scanner results. You should be comfortable investigating findings, reproducing vulnerabilities, assessing exploitability and business impact, and providing developers with practical guidance on how to resolve issues. Strong AWS security experience is required . This is primarily an application and API security position rather than a traditional infrastructure or DevOps role. Responsibilities Assess security across web applications, APIs, and supporting cloud environments. Investigate and validate vulnerabilities identified through automated security tools, penetration testing, and internal assessments. Manually reproduce potential vulnerabilities to determine exploitability and eliminate false positives. Perform hands-on testing of APIs and applications, with particular attention to authentication, authorization, access controls, session management, injection, and business-logic weaknesses. Evaluate issues such as IDOR/BOLA, privilege escalation, authorization bypasses, and other OWASP-related vulnerabilities. Prioritize findings based on technical severity, exploitability, data exposure, and business impact. Partner with development teams to provide practical remediation guidance and verify that fixes fully address identified vulnerabilities. Conduct secure code reviews and participate in threat modeling for new applications, APIs, and features. Manage and improve SAST and DAST capabilities, including tool configuration, tuning, quality gates, and false-positive reduction. Incorporate application security testing into software development workflows and establish appropriate security gates. Assess application risks associated with AWS services and configurations, including IAM, S3, Lambda, API Gateway, secrets management, and WAF. Evaluate cloud-to-application attack paths and determine how AWS configurations may increase the impact of application vulnerabilities. Identify recurring vulnerability patterns and recommend broader engineering or architectural improvements. Track remediation progress and communicate vulnerability trends, risk, and security posture to engineering and security leadership. Continuously identify opportunities to improve application security processes, tooling, and standards. Required Qualifications 5+ years of experience in application security, product security, penetration testing, vulnerability research, or a related security discipline. Strong hands-on experience assessing web applications and APIs . Deep understanding of the OWASP Top 10 and OWASP API Security Top 10 . Experience manually validating vulnerabilities rather than relying solely on automated scanner results. Experience testing REST APIs; GraphQL security experience is beneficial. Hands-on experience with Burp Suite or similar manual application security testing tools . Experience operating and tuning SAST and DAST technologies. Ability to read and review application code in at least one modern programming language such as Java, Python, JavaScript/TypeScript, or Go. Strong working knowledge of AWS security , particularly IAM and application-related AWS services. Experience with vulnerability management and cloud/application security platforms. Ability to translate technical security findings into clear remediation recommendations. Strong communication skills and the ability to influence engineering teams when security changes are required. Preferred Experience Experience with Wiz, Qualys, Snyk, SonarQube , or comparable cloud security, vulnerability management, SAST, and DAST technologies is preferred. Devsecops - JD-silversearch Additional experience with security automation/SOAR, automated or AI-assisted security testing, custom application security rules, threat modeling, and offensive security testing is beneficial. Certifications focused on AWS security or offensive/application security are also a plus.
11/06/2026
Full time
Job Description Job Description We are looking for an experienced Application Security Engineer to take a hands-on role in improving security across a broad portfolio of web applications and APIs. This person will partner closely with software engineering teams to identify security weaknesses, determine which issues present meaningful risk, and drive remediation through completion. The role requires someone who can go beyond automated scanner results. You should be comfortable investigating findings, reproducing vulnerabilities, assessing exploitability and business impact, and providing developers with practical guidance on how to resolve issues. Strong AWS security experience is required . This is primarily an application and API security position rather than a traditional infrastructure or DevOps role. Responsibilities Assess security across web applications, APIs, and supporting cloud environments. Investigate and validate vulnerabilities identified through automated security tools, penetration testing, and internal assessments. Manually reproduce potential vulnerabilities to determine exploitability and eliminate false positives. Perform hands-on testing of APIs and applications, with particular attention to authentication, authorization, access controls, session management, injection, and business-logic weaknesses. Evaluate issues such as IDOR/BOLA, privilege escalation, authorization bypasses, and other OWASP-related vulnerabilities. Prioritize findings based on technical severity, exploitability, data exposure, and business impact. Partner with development teams to provide practical remediation guidance and verify that fixes fully address identified vulnerabilities. Conduct secure code reviews and participate in threat modeling for new applications, APIs, and features. Manage and improve SAST and DAST capabilities, including tool configuration, tuning, quality gates, and false-positive reduction. Incorporate application security testing into software development workflows and establish appropriate security gates. Assess application risks associated with AWS services and configurations, including IAM, S3, Lambda, API Gateway, secrets management, and WAF. Evaluate cloud-to-application attack paths and determine how AWS configurations may increase the impact of application vulnerabilities. Identify recurring vulnerability patterns and recommend broader engineering or architectural improvements. Track remediation progress and communicate vulnerability trends, risk, and security posture to engineering and security leadership. Continuously identify opportunities to improve application security processes, tooling, and standards. Required Qualifications 5+ years of experience in application security, product security, penetration testing, vulnerability research, or a related security discipline. Strong hands-on experience assessing web applications and APIs . Deep understanding of the OWASP Top 10 and OWASP API Security Top 10 . Experience manually validating vulnerabilities rather than relying solely on automated scanner results. Experience testing REST APIs; GraphQL security experience is beneficial. Hands-on experience with Burp Suite or similar manual application security testing tools . Experience operating and tuning SAST and DAST technologies. Ability to read and review application code in at least one modern programming language such as Java, Python, JavaScript/TypeScript, or Go. Strong working knowledge of AWS security , particularly IAM and application-related AWS services. Experience with vulnerability management and cloud/application security platforms. Ability to translate technical security findings into clear remediation recommendations. Strong communication skills and the ability to influence engineering teams when security changes are required. Preferred Experience Experience with Wiz, Qualys, Snyk, SonarQube , or comparable cloud security, vulnerability management, SAST, and DAST technologies is preferred. Devsecops - JD-silversearch Additional experience with security automation/SOAR, automated or AI-assisted security testing, custom application security rules, threat modeling, and offensive security testing is beneficial. Certifications focused on AWS security or offensive/application security are also a plus.
Job Description Job Description Security Risk Advisors Intl., LLC (SRA) is offering a Cloud Security Engineer position. This role is responsible for designing, implementing, and maintaining security controls across SRA's multi-cloud environment, spanning Microsoft Azure/Entra ID, Google Cloud Platform (GCP), and Amazon Web Services (AWS). The Cloud Security Engineer will work closely with internal IT, security operations, and engineering teams to ensure cloud infrastructure is deployed and maintained in a secure, compliant, and resilient manner. Essential Functions Design, implement, and maintain cloud security architectures across Azure/Entra ID, GCP, and AWS environments. Administer and continuously improve cloud identity and access management (IAM) policies, roles, and privilege models across all three platforms. Monitor cloud environments for misconfigurations, threats, and vulnerabilities using cloud-native and third-party security tooling (e.g., Defender for Cloud, Security Command Center, AWS Security Hub). Operationalize cloud vulnerability and patch management processes, ensuring timely remediation of identified risks. Implement and maintain Cloud Security Posture Management (CSPM) solutions to enforce security baselines and compliance standards. Develop and enforce cloud security policies, standards, and guardrails (e.g., Azure Policy, GCP Organization Policies, AWS SCPs). Collaborate with engineering and DevOps teams to embed security into CI/CD pipelines and infrastructure-as-code (IaC) workflows. Conduct cloud security assessments and architecture reviews for new and existing environments. Support incident response activities related to cloud infrastructure, including investigation, containment, and remediation. Create and maintain technical documentation for cloud security architectures, configurations, and operational procedures. Research and evaluate emerging cloud security technologies and provide recommendations for adoption. Develop detection content and security analytics in SRA's internal SOC applicable to cloud environments. Requirements Competencies In-depth understanding of: Microsoft Azure and Entra ID, including conditional access, PIM, and Defender for Cloud Google Cloud Platform (GCP) security services, including Security Command Center, IAM, and VPC Service Controls Amazon Web Services (AWS) security services, including IAM, GuardDuty, Security Hub, and AWS Config Cloud identity and access management principles and zero trust architecture Working knowledge of: Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platforms (CWPP) Infrastructure-as-Code (IaC) tools such as Terraform, Bicep, or CloudFormation Networking concepts as applied to cloud environments (VPCs, peering, private endpoints, firewalls) SIEM and EDR technologies in cloud-integrated environments Experience with: CI/CD pipeline security and DevSecOps practices Organizing or supporting penetration testing, purple team exercises, or cloud-focused security assessments Compliance frameworks relevant to cloud environments (e.g., CIS Benchmarks, NIST CSF, SOC 2) Moderate experience with: Scripting and automation using Python, PowerShell, or Bash Automation via tools such as Power Automate, Logic Apps, or cloud-native orchestration services Supervisory Responsibility None Work Environment This job operates on-site in a professional office environment or remotely as needed/required. This role routinely uses standard office equipment. Physical Demands The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. While performing the duties of this job, the employee is regularly required to talk and hear; use hands to finger, handle, or feel; and reach with hands and arms. The employee frequently is required to stand and walk. This is a largely sedentary role. Candidates with disabilities are encouraged to apply and email with any questions. Reasonable accommodations may be made to enable disabled individuals to perform the essential functions of this role. Position Type/Expected Hours of Work This is a full-time position and hours of work and days are Monday through Friday 8:30am to 5pm. Occasional evening and weekend work may be required as job duties demand. Travel Less than 5%. Required Education and Experience Punctuality and timely attendance to external client and internal stakeholder needs. A bachelor's degree in Information Technology, Computer Science, or a similar field of study, or equivalent experience. 3+ years of hands-on experience in cloud security engineering or a related role, with demonstrable experience across at least two of the three major cloud platforms (Azure, GCP, AWS). Relevant cloud security certifications preferred (e.g., AZ-500, SC-100, Google PCSE, AWS Security Specialty). A passion for learning about cloud security, emerging technologies, and threat landscapes. Excellent verbal and written communication skills. Strong time management and organizational skills. Other Duties Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice. EEO Statement Security Risk Advisors is an Equal Opportunity Employer and prohibits discrimination or harassment of any kind. All employment decisions at SRA are based on business needs, job requirements, and individual qualifications, without regard to race, color, sex, sexual orientation, gender identity or expression, age, religion, national origin, disability, marital or family status, veteran status, medical condition, or any similar category protected under federal, state, or local laws. Benefits Work with Experts : Robust internal training program, plus Company-paid external training. SRA recognizes the value of professional development for employees. Therefore, we encourage our employees to pursue continuing education and role-specific training. Every SRA employee is eligible to attend one training per year paid for by SRA. Mental Health Services : SRA has partnered with BetterHelp to provide SRA employees with free mental health support. BetterHelp connects individuals with licensed therapists for chat, video, and phone sessions. Medical / Dental / Other (regular full-time employees only) Generous medical, dental, and vision benefits at different price points. Company-paid disability and life insurance. Company 401(k) plan including annual 3% safe harbor contribution. Free patient advocacy service that helps find care providers and resolve insurance queries. Free financial advising. Generous parental leave, sick leave, and vacation policies. Possibility to work remotely or with a flexible schedule when needed and approved. Company-paid cell phone with discounted accessories. 1-2-3 Give Program: 1. SRA will give $1,000 to a charity of your choice. 2. If you give an additional amount (up to $1,000), then 3. SRA will match that amount up to $1,000. Other discounted, employee-paid benefits including pet insurance, legal support, and voluntary life insurance. SRA's mission is to level up every day to protect our clients and their customers. This begins with our team members and their experience. SRA prides itself on maintaining a culture where team members have a shared sense of support and belonging, consistent with our It's Personal company value. At SRA, we prioritize transparent career pathing, varied DEI programming and community groups, competitive benefits including mental health support, and an emphasis on a sustainable, healthy, and engaging work culture. SRA has twice been named a Best Place to Work by the Philadelphia Business Journal. These Essential Functions, Requirements, and Skills are guidelines. If you are a candidate who does not meet this exact job description but can demonstrate excellent organization, attention to detail, professionalism, flexibility, and self-direction in your professional background, we hope you apply. SRA values a diverse workplace and strongly encourages women, people of color, LGBTQ+ individuals, people with disabilities, members of ethnic minorities, and veterans to apply. Salary Range : $90k - 130k
11/06/2026
Full time
Job Description Job Description Security Risk Advisors Intl., LLC (SRA) is offering a Cloud Security Engineer position. This role is responsible for designing, implementing, and maintaining security controls across SRA's multi-cloud environment, spanning Microsoft Azure/Entra ID, Google Cloud Platform (GCP), and Amazon Web Services (AWS). The Cloud Security Engineer will work closely with internal IT, security operations, and engineering teams to ensure cloud infrastructure is deployed and maintained in a secure, compliant, and resilient manner. Essential Functions Design, implement, and maintain cloud security architectures across Azure/Entra ID, GCP, and AWS environments. Administer and continuously improve cloud identity and access management (IAM) policies, roles, and privilege models across all three platforms. Monitor cloud environments for misconfigurations, threats, and vulnerabilities using cloud-native and third-party security tooling (e.g., Defender for Cloud, Security Command Center, AWS Security Hub). Operationalize cloud vulnerability and patch management processes, ensuring timely remediation of identified risks. Implement and maintain Cloud Security Posture Management (CSPM) solutions to enforce security baselines and compliance standards. Develop and enforce cloud security policies, standards, and guardrails (e.g., Azure Policy, GCP Organization Policies, AWS SCPs). Collaborate with engineering and DevOps teams to embed security into CI/CD pipelines and infrastructure-as-code (IaC) workflows. Conduct cloud security assessments and architecture reviews for new and existing environments. Support incident response activities related to cloud infrastructure, including investigation, containment, and remediation. Create and maintain technical documentation for cloud security architectures, configurations, and operational procedures. Research and evaluate emerging cloud security technologies and provide recommendations for adoption. Develop detection content and security analytics in SRA's internal SOC applicable to cloud environments. Requirements Competencies In-depth understanding of: Microsoft Azure and Entra ID, including conditional access, PIM, and Defender for Cloud Google Cloud Platform (GCP) security services, including Security Command Center, IAM, and VPC Service Controls Amazon Web Services (AWS) security services, including IAM, GuardDuty, Security Hub, and AWS Config Cloud identity and access management principles and zero trust architecture Working knowledge of: Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platforms (CWPP) Infrastructure-as-Code (IaC) tools such as Terraform, Bicep, or CloudFormation Networking concepts as applied to cloud environments (VPCs, peering, private endpoints, firewalls) SIEM and EDR technologies in cloud-integrated environments Experience with: CI/CD pipeline security and DevSecOps practices Organizing or supporting penetration testing, purple team exercises, or cloud-focused security assessments Compliance frameworks relevant to cloud environments (e.g., CIS Benchmarks, NIST CSF, SOC 2) Moderate experience with: Scripting and automation using Python, PowerShell, or Bash Automation via tools such as Power Automate, Logic Apps, or cloud-native orchestration services Supervisory Responsibility None Work Environment This job operates on-site in a professional office environment or remotely as needed/required. This role routinely uses standard office equipment. Physical Demands The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. While performing the duties of this job, the employee is regularly required to talk and hear; use hands to finger, handle, or feel; and reach with hands and arms. The employee frequently is required to stand and walk. This is a largely sedentary role. Candidates with disabilities are encouraged to apply and email with any questions. Reasonable accommodations may be made to enable disabled individuals to perform the essential functions of this role. Position Type/Expected Hours of Work This is a full-time position and hours of work and days are Monday through Friday 8:30am to 5pm. Occasional evening and weekend work may be required as job duties demand. Travel Less than 5%. Required Education and Experience Punctuality and timely attendance to external client and internal stakeholder needs. A bachelor's degree in Information Technology, Computer Science, or a similar field of study, or equivalent experience. 3+ years of hands-on experience in cloud security engineering or a related role, with demonstrable experience across at least two of the three major cloud platforms (Azure, GCP, AWS). Relevant cloud security certifications preferred (e.g., AZ-500, SC-100, Google PCSE, AWS Security Specialty). A passion for learning about cloud security, emerging technologies, and threat landscapes. Excellent verbal and written communication skills. Strong time management and organizational skills. Other Duties Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice. EEO Statement Security Risk Advisors is an Equal Opportunity Employer and prohibits discrimination or harassment of any kind. All employment decisions at SRA are based on business needs, job requirements, and individual qualifications, without regard to race, color, sex, sexual orientation, gender identity or expression, age, religion, national origin, disability, marital or family status, veteran status, medical condition, or any similar category protected under federal, state, or local laws. Benefits Work with Experts : Robust internal training program, plus Company-paid external training. SRA recognizes the value of professional development for employees. Therefore, we encourage our employees to pursue continuing education and role-specific training. Every SRA employee is eligible to attend one training per year paid for by SRA. Mental Health Services : SRA has partnered with BetterHelp to provide SRA employees with free mental health support. BetterHelp connects individuals with licensed therapists for chat, video, and phone sessions. Medical / Dental / Other (regular full-time employees only) Generous medical, dental, and vision benefits at different price points. Company-paid disability and life insurance. Company 401(k) plan including annual 3% safe harbor contribution. Free patient advocacy service that helps find care providers and resolve insurance queries. Free financial advising. Generous parental leave, sick leave, and vacation policies. Possibility to work remotely or with a flexible schedule when needed and approved. Company-paid cell phone with discounted accessories. 1-2-3 Give Program: 1. SRA will give $1,000 to a charity of your choice. 2. If you give an additional amount (up to $1,000), then 3. SRA will match that amount up to $1,000. Other discounted, employee-paid benefits including pet insurance, legal support, and voluntary life insurance. SRA's mission is to level up every day to protect our clients and their customers. This begins with our team members and their experience. SRA prides itself on maintaining a culture where team members have a shared sense of support and belonging, consistent with our It's Personal company value. At SRA, we prioritize transparent career pathing, varied DEI programming and community groups, competitive benefits including mental health support, and an emphasis on a sustainable, healthy, and engaging work culture. SRA has twice been named a Best Place to Work by the Philadelphia Business Journal. These Essential Functions, Requirements, and Skills are guidelines. If you are a candidate who does not meet this exact job description but can demonstrate excellent organization, attention to detail, professionalism, flexibility, and self-direction in your professional background, we hope you apply. SRA values a diverse workplace and strongly encourages women, people of color, LGBTQ+ individuals, people with disabilities, members of ethnic minorities, and veterans to apply. Salary Range : $90k - 130k
Job Description Job Description About the Company We are a renewable energy and ocean technology company committed to rapidly developing and deploying technologies that will ensure a sustainable future for Earth by unlocking the vast energy potential of its oceans. Our focus is on capturing civilizational levels of ultra-low-cost renewable energy for applications including computing and affordable renewable fuels delivered to shore. The company is a public benefit corporation headquartered in Portland, Oregon, and backed by leading venture capitalists, philanthropic investors, university endowments, and private investment offices. We operate as an idea meritocracy in which the best ideas change the company's direction on a regular basis. Our staff have worked at organizations such as SpaceX, Blue Origin, Boeing, Tesla, Apple, Virgin Orbit, Astra, Google, Amazon, Microsoft, New Relic, Bridgewater, Raytheon, Disney Imagineering, and the US Army and Air Force, as well as research universities, startups, and small companies across a range of industries. About the Job Our core technology is the node, a device that produces energy in the ocean's harshest conditions for years at a time without human maintenance or intervention. As a Lead Application Security Engineer, you will play a key role in advancing Panthalassa's application security capabilities, partnering closely with the Director of Information Security and software engineering teams. You will bring broad application security and software engineering expertise, strong technical judgment, and the ability to quickly understand unfamiliar languages, frameworks, and architectures. Candidates should possess broad application security and software engineering skills, and be able to quickly come up to speed with languages and frameworks with which they have not previously worked. Candidates should have strong interpersonal skills and be able to thrive in a creative, scrappy, and collaborative environment in which the best ideas change the company's direction on a regular basis. Responsibilities Assist the Head of Information Security with building out the AppSec function at Panthalassa. Conduct code and service architecture reviews to provide security guidance. Lead engineers in threat modelling applications and services. Work with the Head of Information Security to define culturally useful software security metrics. Assist in interviewing and onboarding of other Security personnel. Assist with incident response and handling now while we grow, and provide escalation support for incidents later as we have grown. Integrate, maintain, and automate security scanning tools (SAST, DAST, SCA, and secrets management) directly into our CI/CD pipelines. Build and integrate agentic security tools for Panthalassa needs. Conduct hands-on threat modeling and architectural design reviews for new features and applications before code is written. Perform manual and automated secure code reviews as well as targeted penetration testing on web and mobile applications. Help manage the company's external Vulnerability Disclosure or Bug Bounty programs and translate regulatory compliance requirements into practical engineering tasks. Required Qualifications 6+ years of experience with Application Security processes. 2+ years of experience as a Team Lead or Manager of an Application Security team. Both broad in general and deep in places Application Security foundational knowledge. Experience with using AI systems and agents for security outcomes in a professional capacity. Deep understanding of the OWASP Top 10, CWE Top 25, and secure design patterns. Hands-on experience with industry-standard security tools (e.g. Snyk, GitHub Advanced Security, Burp Suite, Fortify). Bachelor's degree in Computer Science, Cybersecurity, or equivalent practical experience. Desired Qualifications Experience with software development work related to mechanical engineering environments. Familiarity with cloud platforms (AWS, Azure, or GCP) and modern infrastructure tools like Docker, Kubernetes, and Infrastructure as Code (IaC). The above qualifications are desired, not required. We encourage you to apply if you are a strong candidate with only some of the desired skills and experience listed. Additional Requirements Travel to conferences, vendors and test sites as needed. Intermittently able to work longer hours and weekends to support critical needs. While we expect a lot of each other, we also offer a high degree of autonomy and work-life balance, including flexible PTO and flexible working hours. Compensation and Benefits If hired for this full-time role, you will receive: Cash compensation of $200,000 - $260,000. Equity in the company. We're all owners and if we're successful, this equity should be far and away the most valuable component of your compensation. A benefits package that helps you take care of yourself and your family, including: Flexible paid time off Health insurance (the company pays 100% of gold-level PPO plan for full-time employees, their partners, and dependents) Dental insurance (the company pays 100% for full-time employees, their partners, and dependents) Vision insurance (the company pays 100% for full-time employees, their partners, and dependents) Disability insurance (the company pays 100% for a policy to provide long-term financial support if you become disabled) Ability to contribute to tax-advantaged accounts, including 401(k), health FSA, and dependent care FSA Relocation assistance to facilitate your move to Portland (if needed). Location This is an on-site position. Our offices, lab, and shop are located in Portland, Oregon.
11/06/2026
Full time
Job Description Job Description About the Company We are a renewable energy and ocean technology company committed to rapidly developing and deploying technologies that will ensure a sustainable future for Earth by unlocking the vast energy potential of its oceans. Our focus is on capturing civilizational levels of ultra-low-cost renewable energy for applications including computing and affordable renewable fuels delivered to shore. The company is a public benefit corporation headquartered in Portland, Oregon, and backed by leading venture capitalists, philanthropic investors, university endowments, and private investment offices. We operate as an idea meritocracy in which the best ideas change the company's direction on a regular basis. Our staff have worked at organizations such as SpaceX, Blue Origin, Boeing, Tesla, Apple, Virgin Orbit, Astra, Google, Amazon, Microsoft, New Relic, Bridgewater, Raytheon, Disney Imagineering, and the US Army and Air Force, as well as research universities, startups, and small companies across a range of industries. About the Job Our core technology is the node, a device that produces energy in the ocean's harshest conditions for years at a time without human maintenance or intervention. As a Lead Application Security Engineer, you will play a key role in advancing Panthalassa's application security capabilities, partnering closely with the Director of Information Security and software engineering teams. You will bring broad application security and software engineering expertise, strong technical judgment, and the ability to quickly understand unfamiliar languages, frameworks, and architectures. Candidates should possess broad application security and software engineering skills, and be able to quickly come up to speed with languages and frameworks with which they have not previously worked. Candidates should have strong interpersonal skills and be able to thrive in a creative, scrappy, and collaborative environment in which the best ideas change the company's direction on a regular basis. Responsibilities Assist the Head of Information Security with building out the AppSec function at Panthalassa. Conduct code and service architecture reviews to provide security guidance. Lead engineers in threat modelling applications and services. Work with the Head of Information Security to define culturally useful software security metrics. Assist in interviewing and onboarding of other Security personnel. Assist with incident response and handling now while we grow, and provide escalation support for incidents later as we have grown. Integrate, maintain, and automate security scanning tools (SAST, DAST, SCA, and secrets management) directly into our CI/CD pipelines. Build and integrate agentic security tools for Panthalassa needs. Conduct hands-on threat modeling and architectural design reviews for new features and applications before code is written. Perform manual and automated secure code reviews as well as targeted penetration testing on web and mobile applications. Help manage the company's external Vulnerability Disclosure or Bug Bounty programs and translate regulatory compliance requirements into practical engineering tasks. Required Qualifications 6+ years of experience with Application Security processes. 2+ years of experience as a Team Lead or Manager of an Application Security team. Both broad in general and deep in places Application Security foundational knowledge. Experience with using AI systems and agents for security outcomes in a professional capacity. Deep understanding of the OWASP Top 10, CWE Top 25, and secure design patterns. Hands-on experience with industry-standard security tools (e.g. Snyk, GitHub Advanced Security, Burp Suite, Fortify). Bachelor's degree in Computer Science, Cybersecurity, or equivalent practical experience. Desired Qualifications Experience with software development work related to mechanical engineering environments. Familiarity with cloud platforms (AWS, Azure, or GCP) and modern infrastructure tools like Docker, Kubernetes, and Infrastructure as Code (IaC). The above qualifications are desired, not required. We encourage you to apply if you are a strong candidate with only some of the desired skills and experience listed. Additional Requirements Travel to conferences, vendors and test sites as needed. Intermittently able to work longer hours and weekends to support critical needs. While we expect a lot of each other, we also offer a high degree of autonomy and work-life balance, including flexible PTO and flexible working hours. Compensation and Benefits If hired for this full-time role, you will receive: Cash compensation of $200,000 - $260,000. Equity in the company. We're all owners and if we're successful, this equity should be far and away the most valuable component of your compensation. A benefits package that helps you take care of yourself and your family, including: Flexible paid time off Health insurance (the company pays 100% of gold-level PPO plan for full-time employees, their partners, and dependents) Dental insurance (the company pays 100% for full-time employees, their partners, and dependents) Vision insurance (the company pays 100% for full-time employees, their partners, and dependents) Disability insurance (the company pays 100% for a policy to provide long-term financial support if you become disabled) Ability to contribute to tax-advantaged accounts, including 401(k), health FSA, and dependent care FSA Relocation assistance to facilitate your move to Portland (if needed). Location This is an on-site position. Our offices, lab, and shop are located in Portland, Oregon.