Sr Security Engineer
TLDR
Design and maintain enterprise-grade security across Kobie's cloud-native stack, lead controls, threat modeling, and CI/CD security automation.
-
Design, implement, and maintain security controls across cloud infrastructure, applications, and network environments
-
Conduct vulnerability assessments, penetration testing, and threat modeling to proactively identify and remediate security risks
-
Monitor security events and alerts using SIEM tooling, investigating incidents and driving timely remediation
-
Partner with Cloud Engineering, DevOps, and application teams to embed security best practices into CI/CD pipelines and infrastructure-as-code workflows
-
Support the development and enforcement of security policies, standards, and compliance frameworks (e.g., SOC 2, NIST CSF, PCI-DSS)
-
Lead or contribute to security incident response activities, including root cause analysis and post-incident reviews
-
Implement and manage identity and access management (IAM) controls, including least-privilege enforcement, privileged access management, and conditional access policies; enforce network and host-based data loss prevention (DLP), information protection, and endpoint security controls across the enterprise environment
-
Evaluate and manage third-party security tools and vendor risk assessments; conduct security reviews of end user applications and software to support an approved software process, ensuring only vetted and compliant tools are introduced into the environment
-
Drive automation of security operations broadly, including testing, compliance checks, threat detection, triage, and response workflows; leverage AI-assisted tooling to accelerate analysis, reduce manual effort, and increase coverage across the security program
-
Maintain accurate and thorough security documentation including runbooks, threat models, and risk registers
-
Act as a security subject matter expert, advising engineering and product teams on secure design and coding practices
-
Proactively track emerging threats, vulnerabilities, and industry trends to continuously strengthen Kobie’s security posture
-
Train and develop team members on security and compliance practices, tools, and frameworks, fostering a culture of security awareness and continuous improvement
-
5+ years of experience in information security, cybersecurity engineering, or a related technical discipline
-
3+ years of hands-on experience securing cloud environments (AWS preferred), including IAM, VPC security, security groups, and cloud-native security services (e.g., AWS GuardDuty, Security Hub, CloudTrail)
-
Experience with SIEM platforms and security event monitoring, alerting, and incident response workflows
-
Proficiency in vulnerability management tools and processes, including experience conducting or coordinating penetration testing
-
Solid understanding of network security concepts including firewalls, WAFs, IDS/IPS, DNS security, and zero-trust principles
-
Experience with identity and access management including SSO, MFA, OAuth, and privileged access management (PAM) solutions
-
Hands-on experience integrating security into CI/CD pipelines (DevSecOps), including static/dynamic analysis tools and secrets management
-
Familiarity with compliance frameworks such as SOC 2, ISO 27001, NIST CSF v2.0, PCI-DSS, and their technical implementation requirements; working knowledge of AI-specific frameworks (e.g., NIST AI RMF, ISO 42001) is a plus
-
Working knowledge of data privacy regulations and their operational security implications, including GDPR and CCPA
-
Hands-on experience implementing and managing conditional access policies, network and host-based DLP, information protection classifications, and endpoint security controls within an enterprise security platform
-
Scripting or automation experience (Python, Bash, or similar) for security tooling and workflow automation; comfort leveraging AI-assisted tools to enhance and accelerate security operations, analysis, and process development
-
Strong Linux administration skills, preferably with RHEL-based systems
-
Excellent analytical and problem-solving skills with the ability to assess complex risk scenarios and communicate findings clearly
-
Strong written and verbal communication skills, with ability to present technical security concepts to non-technical stakeholders
-
Experience mentoring or developing junior security team members, or demonstrated ability to contribute to team capability growth through training, knowledge transfer, or documentation
-
Relevant security certifications such as CISSP, CISM, OSCP, AWS Security Specialty, or equivalent are a plus
Benefits
Health Insurance
comprehensive health coverage
Annual fundraiser
Paid Time Off
work-life balance
Wellness Stipend
well-being perks