5+ years in security engineering, application security, or cloud security
Hands-on experience securing AWS environments
Strong understanding of web and mobile application security, including the OWASP Top 10
Proficient in at least one programming language (Rust, Python, Go, or TypeScript)
Experience leading incident response efforts
Ability to communicate risks and provide practical solutions to engineers
Responsibilities
Identify and remediate vulnerabilities in mobile, web, and backend applications
Secure AWS infrastructure, focusing on access management and networking
Conduct threat modeling and security reviews for new features
Integrate security checks into CI/CD processes, including code scanning
Lead incident detection and response, managing logging and alerting
Stay updated on security news and share relevant insights with the team
Prevent account takeovers, bots, and abuse on platforms
Oversee penetration tests, bug bounty programs, and vendor security assessments
Support compliance initiatives like PCI DSS and privacy regulations
Train engineering teams on secure coding practices
Benefits
In-person work environment in New York City, fostering team collaboration
Opportunity to lead security initiatives from the ground up
Engagement with cutting-edge security practices and technologies
Chance to influence security culture within a growing company
Professional development opportunities in a dynamic field
Full Job Description
About the Role
We're hiring a Senior Security Engineer to protect IcyBox, our customers and their data. You'll own security across our apps, cloud infrastructure and internal systems, and help the team build securely without slowing down. This role is in person at our New York City office, five days a week.
What You'll Do
Find and fix vulnerabilities across our mobile, web, and backend apps
Secure our AWS environment, including access management, networking and secrets
Run threat modeling and security reviews for new features
Build security checks into CI/CD, such as code scanning and dependency checks
Lead incident detection and response, including logging, alerting and playbooks
Follow security news and disseminate relevant information to the team
Prevent account takeover, bots and abuse on our site and app
Manage penetration tests, bug bounty reports and vendor security reviews
Support compliance work such as PCI DSS and privacy laws
Train engineers on secure coding
What We're Looking For
5+ years in security engineering, application security or cloud security
Hands-on experience securing AWS environments
Strong understanding of web and mobile application security, including the OWASP Top 10
Able to read and write code in at least one language, such as Rust, Python, Go or TypeScript
Experience leading incident response
Able to explain risk clearly and give engineers practical fixes
Nice to Have
Experience working with production Rust, React, and React Native systems
E-commerce or payments security experience, including PCI DSS
Fraud, bot and account takeover prevention
SIEM tools and detection engineering
Certifications such as OSCP, CISSP or AWS Certified Security - Specialty
First security hire or early security team experience at a startup
