Principal Security Engineer

Do you thrive in fast-moving environments safeguarding critical systems? Are you passionate about staying ahead of the ever-evolving cyber threat landscape? If so, we want you on our team! We are seeking a seasoned Principal Security Engineer to join our growing security team. As a senior-level cybersecurity professional, you will play a pivotal role in designing, implementing, and managing our organization's security posture. You will be a trusted advisor to leadership, providing strategic direction and ensuring our security solutions align with industry best practices and compliance requirements. Responsibilities Reporting directly to the CISO, this position offers executive-level exposure and cross-departmental experience. The individual will have the opportunity to make impactful contributions as they manage mission-critical initiatives and projects. The position will involve direct interaction with the executive team and corporate partners. - Architect Secure Solutions: Design, implement, and maintain a comprehensive security architecture that safeguards our critical infrastructure, data, and applications. - Design, implement, and maintain robust security controls and countermeasures across our IT and Product Cloud infrastructure. - Collaborate with Product, Engineering, and other departments to integrate security best practices into business processes. - Lead Threat Defense: Champion proactive security measures. - Mentor a team of SecOps engineers, providing guidance and support in implementing security best practices. - Develop and implement security policies, standards, and procedures to ensure compliance with regulatory requirements and industry best practices. - Collaborate with development, operations, and security teams to integrate security into the software development lifecycle (SDLC) and CI/CD pipeline. - Conduct security assessments, code reviews, and penetration testing to identify and mitigate vulnerabilities. - Design and implement security controls for infrastructure as code (IaC), cloud environments, and containerized applications. - Automate security testing and compliance checks using scripting and configuration management tools. - Monitor and analyze security events and incidents, leading incident response efforts to minimize impact and prevent recurrence. - Stay informed about emerging security threats, vulnerabilities, and industry trends, providing guidance on mitigation strategies. - Partner with senior leadership to prioritize security initiatives and allocate resources effectively. - Design and Implement automated monitoring and logging across the development and deployment pipeline to detect security incidents in real-time. - Utilize security tools to monitor for suspicious activities and indicators of compromise. - Integrate security alerts and notifications into the CI/CD pipeline to facilitate rapid detection and response. - Upon detection of a security incident, initiate a thorough investigation to assess the scope and impact of the incident. - Analyze logs, network traffic, and system configurations to identify the root cause of the incident and determine the extent of any compromise. - Collaborate with development, operations, and security teams to gather relevant information and context for incident analysis. - Compliance Champion: Ensure adherence to industry regulations and security compliance frameworks (e.g., PCI DSS, HIPAA, SOC 2). - Security Advocacy & Awareness: Champion a culture of security awareness within the organization, developing and implementing security training programs for employees. Qualifications: - Minimum 10 years of experience in information security with a proven track record of success in a similar role. - In-depth knowledge of security principles, technologies, and methodologies (e.g., firewalls, intrusion detection/prevention systems, encryption, IAM). - In-depth understanding of DevOps principles, methodologies, and tools. - Hands-on experience with cloud platforms (e.g., AWS, Azure, GCP), containerization technologies (e.g., Docker, Kubernetes), and infrastructure as code (IaC) tools. - Proficiency in scripting languages such as Python, PowerShell, or Bash. - Familiarity with compliance standards such as PCI DSS, SOC II, and ISO27001. - Excellent communication, collaboration, and problem-solving skills. - Knowledge of secure software development frameworks (e.g., OWASP). - Experience implementing security in Agile and DevOps environments. Preferred Qualifications: - Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience). - Security certifications such as CISSP, CISM, or AWS Certified Security Specialty. - Deep Experience in the following technologies: - Cloudflare - Crowdstrike - Proofpoint - CyberArk EPM - BurpSuite - Amazon Security Hub, Guard Duty, Inspector - JumpCloud - Snyk - Experience in developing security budgets Compensation We share compensation up front so you have the information you need to make a confident decision. This range reflects target base compensation. Where you land depends on skills and experience. If this range works for you, we encourage you to apply. Salary Range: $175,800.00-219,750.00 Benefits Confidence, built in. The same confidence we build for car buyers and sellers, we build into how we treat our own: - Medical, dental & vision from day one - no waiting period - 401(k) with company match, immediate vesting - Employee Stock Purchase Plan - buy Cars.com stock at a discount - Unlimited Flex Time Off, 11 paid holidays, 1 volunteer day - Paid parental and caregiver leave - $350 one-time home office stipend + $70/month for virtual-first work - Tuition reimbursement up to $5,250/year - ...and more - see our full Benefits, Perks & Culture here