Remofirst
Lead Security Engineer
Rol remoto de Security Engineering con fit claro de ubicación del candidato.
Publicado5 jul 2026
Países elegibles7 países aceptados
Señal de senioritySenior
Modelo de trabajoRemoto
Ubicaciones aceptadas para candidatos
Resumen del rol
Lead Security Engineer
Requisitos y responsabilidades
Contenido del rol extraído en secciones para revisar más rápido.
Core Responsibilities:
- 1. Identity & Access Management (The Core)
- Customer Identity: Own the architecture and security of our Auth0 implementation for client-facing applications. You will be fine-tuning our internal authentication service to support SCIM provisioning and help set up the OIDC federation with our enterprise client’s IdPs.
- InternalIdentity: Manage and automate our Okta environment, ensuring seamless SSO, lifecycle management (onboarding/offboarding), and hardware-based MFA. Expect a fairly complex internal RBAC and the need to actually speak with the other functions within the organization to understand their ways of working and translate them into security controls
- Cloud Identity: Enforce "Least Privilege" across our AWS ecosystem, managing complex AWS IAM policies and Service Control Policies (SCPs).
- 2. Security Engineering & Pentesting
- Offensive Security: Conduct regular internal pentests and vulnerability scans against our Python/Django and Java/Spring Boot services as well as coordinate with 3LOD pen testers
- Secure SDLC: Work alongside devs to review code (e.g. implementation of the security library you’ve built), secure our Postgres databases, help engineers with thread modelling and harden our Kafka message streams. You will be the owner of our SAST/DAST and detect license misuse, outdated libraries, and help shape a non-invasive secure SDLC that developers love by building paved roads
- AI Security: Define the guardrails for our AI initiatives, ensuring data privacy in LLM prompts and securing our model pipeline.
- 3. Governance, Risk, and Compliance (GRC)
- The Audit Lead: Take the wheel for our SOC 2 Type II and ISO 27001 certifications. You will be a key person in maintaining our internal risk register as well as helping our Front-line teams with inbound security questionnaires from large clients.
- Automation: Utilize compliance automation tools to ensure we stay "audit-ready" every single day, not just once a year. You will own our “Trust Center” in Thoropass (our compliance platform)
- Policy as Code: Help draft and implement pragmatic security policies that reflect how a modern startup actually works. We are talking about data residency, logging, audit trails, dealing with non-repudiation, etc.
Technical Requirements:
- Familiarity with our core tech stack: Python/Java with Django, FastAPI & SpringBoot is at the heart of our services. We are using Kafka & RabbitMQ for interservice communications and PostgreSQL with some MongoDB on our persistence layer
- Strong knowledge of Cloud Infrastructure: We use AWS with EKS, RDS as well the traditional IAM, S3, etc.
- Internal & User-facing IAM: Comfortable with IAM - some experience with Okta and/or Auth0. Good understanding of protocols like SAML, OIDC, understanding of API-based security
- Compliance: Familiarity with the SOC2 and ISO27001 audit cycle, comfortable with working with Risk & Compliance teams, both internal and external
Who You Are:
- The Builder: You have 5+ years of experience in security engineering. You prefer an IDE to a spreadsheet.
- The Auditor-Translator: You can explain complex ISO 27001 requirements to a software engineer in a way that makes sense to them.
- The Pragmatist: You understand that "No" is not always the answer. You find ways to enable the business to move fast, safely.
- Bonus points - An AI Enthusiast: You are keeping up with the OWASP Top 10 for LLMs and understand the risks of prompt injection and data leakage.
Roles similares
Mantén una lista de respaldo.
AWS, PostgreSQL 4 países aceptados
Senior Backend Engineer (AdTech)Leap ToolsVer rol AWS, PostgreSQL 4 países aceptados
Senior Backend EngineerLeap ToolsVer rol Java, Python 4 países aceptados
Application Security Engineer (Tech Lead)Morgan StanleyVer rol AWS 4 países aceptados
Senior Software EngineerBaltimore BannerVer rol Stack
Usa estas tags para comparar roles remotos similares.
Elegibilidad de ubicación
Candidatos deberían aplicar solo cuando el país del perfil aparece aquí.
Flujo de contratación
WithMira muestra el rol y luego envía candidatos a la aplicación de la empresa.
1Revisa fit del rol, stack y elegibilidad de ubicación en WithMira.
2Abre la página de aplicación de la empresa desde el link rastreado.
3Guarda el rol o suscríbete a oportunidades similares antes de salir.