POSITION SUMMARY:We are hiring a Principal Security Engineer to own security as an engineering discipline, across our cloud environment, corporate network, and physical infrastructure. Security here is built in code and enforced through automation, rather than administered through policy alone. This is a hands-on, senior individual contributor role for an engineer who codes by craft, thinks like an attacker, and has strong opinions about how environments, networks, pipelines and observability should be built.
You will set the technical standard by doing the work: hardening the AWS environment, securing the corporate network and physical infrastructure, embedding security into CI/CD and the SDLC, and using an offensive security mindset to find and close weaknesses before adversaries do. You will shape security-by-design architecture and set the security requirements.
KEY RESPONSIBILITIES:- Proactive Security: Apply offensive-security skills including thread modeling, penetration testing and vulnerability discovery against all systems, to find and remediate weaknesses proactively.
- Security-by-Design Architecture: Shape the environment, deployment and observability strategy so security, reliability and visibility are designed in from the start.
- Identity &Access: Own company-controlled identity and access across Okta, Microsoft 365 / Google Workspace, and AWS, consolidating privileged access under least-privilege governance.
- Network Security: Secure the corporate network and on-premise infrastructure, including firewalls, switches, virtualization hosts and secure remote access.
- Endpoint & Device Security: Own endpoint and device security across the fleet, hardening, patching, encryption, and ensuring all devices are managed and brought under company control.
- Cloud & Pipeline Security: Secure the AWS environment, deployment workflows and release pipeline, integrating automated controls directly into the CI/CD, mapped to recognized frameworks such as NIST CSF.
- Secure Software Delivery: Embed security into the SDLC, including secrets management, dependency and image scanning, and developer guardrails aligned to OWASP sure-coding standards that enable safe, fast delivery.
- Tooling & Visibility: Own security tooling and ensure continuous logging, monitoring, and alerting so the environment stays observable and defensible.
QUALIFICATIONS:Required- 7+ years of professional experience in security and software engineering, with significant hands-on time in DevSecOps and cloud security.
- Solid network security fundamental knowledge with firewalls, segmentation, secure remote access, and securing on-premise / corporate network infrastructure.
- Experience with endpoint and device security, including hardening, patching, encryption and managed device approaches.
- Working fluency with identity and access management (Okta or equivalent) and modern authentication.
- Practical offensive-security ability in threat modelling, penetration testing, or vulnerability research against systems you help build.
- Strong software-engineering fundamentals: you write, review, and ship production-quality code and intend to keep doing so.
- Demonstrated hands-on expertise securing cloud environments (AWS strongly preferred), including identity, network, and workload security.
- Proven experience building security into CI/CD pipelines and the SDLC, including secrets management, dependency / image scanning and automated guardrails.
- Hands-on experience with infrastructure-as-code and policy-as-code (e.g., Terraform, OPA, or similar).
- Working knowledge of security operations fundamentals: logging, monitoring, detection, and incident response.
- A collaborative, low-ego working style and the ability to operate independently in a fast-moving, foundational environment.
Preferred- Depth in offensive security, with practical red-team and / or penetration-testing, experience
- Experience in financial services, fintech, or another regulated industry, with familiarity with frameworks such as NIST, SOC 2, GLBA, or FFIEC guidance.
Salary Range: $160K-$210K
