Security Engineer — Application Security & Identity

Owns application security across multiple environments, each with increasing control and compliance requirements. Acts as reviewer for the least complex environments and co-reviewer for higher complexity and controlled environments. Defines and enforces security controls across AWS hosted workloads and GitHub based development pipelines while maintaining independent review authority. Applications originate as AI-assisted prototypes and require structured security validation before enterprise production deployment.

Responsibilities

Conduct security reviews of internally developed applications including data flow validation, security control design and implementation, secrets handling, and AI/LLM Data Loss Prevention (DLP); Co-lead production readiness reviews for strictly governed environments: threat modeling, hardening validation, and compliance mapping (SOC 2 and contractual and regulatory requirements); Define and enforce identity architecture: corporate identity Entra ID, workload identity AWS IAM and GitHub OIDC; Define and manage GitHub native security controls: GitHub Advanced Security (CodeQL / SAST), Dependabot (dependency scanning), secret scanning, branch protection and environment controls; Establish standards for security tooling: SAST (CodeQL, Semgrep), SCA (Dependabot, Snyk), container scanning (Trivy, ECR scanning), and Infrastructure as Code (IaC) policy (OPA, Sentinel, tfsec); Define AWS security standards: IAM design and least-privilege access, logging and audit requirements, secrets management and rotation; Scope and coordinate third-party penetration testing; Maintain audit logging maturity per environment requirements: baseline logging, user-level activity tracking, tamper-evident audit trails with SIEM integration; Perform initial triage and risk classification within time requirements for critical issues identified in intake (data exposure, credentials, regulatory risk); Partner with DevOps Engineering to ensure security policies are implemented in pipelines and infrastructure; Define approved AI providers and usage boundaries; Establish prompt data classification and handling policies; Enforce human-in-the-loop requirements where appropriate; Define cost/spend guardrails for AI services

Requirements

5+ years (or 3–5+ in high-growth environments) in cloud security, 2 of which should be focused application security; Hands-on security experience with AWS IAM, SAML / OIDC federation, and GitHub security tooling; Experience with threat modeling and coordinating penetration testing; Familiarity with SOC 2, GDPR, and HIPAA-adjacent controls; In-depth understanding of the risk lifecycle

Nice to have

Experience securing GitHub-based CI/CD pipelines; Experience in AWS native environments; Exposure to regulated industries (GxP, 21 CFR Part 11); Security certifications (CISSP, CCSP, OSCP, GIAC, etc.); Associates degree or higher; Experience bringing low-code or AI-generated applications under enterprise security controls

Benefits

Comprehensive benefit program and perks tailored to region; Free snacks in offices; Generous holiday and paid time off; Options for private medical, dental, and vision plans; Support in saving for the future; Mental wellness coaching and support; Access to more than 13,000 online classes with LinkedIn Learning