Security Engineer

Описание вакансии

\* Help connect customer requirements to what we build: turn security and compliance requirements from customers and frameworks into concrete feature and policy proposals, surfacing gaps to the team and roadmap.

\* Strengthen the secure development lifecycle: SAST, DAST, SCA, and secrets scanning across our pipelines.

\* Measure and test what we build: treat detections as code that is peer-reviewed, unit-tested and backtested against historical logs (and, where useful, validated with attack simulation), and track effectiveness quantitatively and qualitatively (MTTD, false-positive rate) to make data-driven decisions.

\* Write production-quality software and automation to streamline security processes, automate response, and reduce manual work.

Secondary Responsibilities

\* Help keep our security answers accurate: a key contributor to customer security questionnaires and RFPs, reviewing and updating existing answers and researching new ones where none exist, drawing on broad SOC 2, ISO and HIPAA knowledge and our existing answer library and tooling. You provide technical input, not the sales process.

\* Support GRC: automate compliance evidence collection and help implement security controls.

\* Contribute to threat modelling and security reviews alongside the rest of the team.

\* Help guide our external penetration-testing partners on major product use cases.

\* Support secure engineering practices and developer security awareness.

WHAT MAKES YOU THRIVE HERE

You have:

\* Solid working knowledge of a major cloud (GCP and/or AWS) and of containers / Kubernetes.

\* Hands-on experience building security monitoring through automation: logging and telemetry, detections, alerting, and automating response (a detection-as-code / infrastructure-as-code mindset).

\* Experience with vulnerability management and coordinated remediation.

\* Broad working knowledge of the security compliance frameworks Hoxhunt operates under (SOC 2, ISO 27001, ISO 42001 and HIPAA), enough to answer customer security questions confidently and support audits, plus awareness of the wider control-framework and regulatory landscape (NIST CSF, CIS, NIS2).

\* Clear written and verbal communication; able to work across teams.

\* Comfortable using modern AI tools to expand your impact, automate repetitive work, and scale your effectiveness.

\* Self-motivated, continuous learning is a must: you actively teach yourself new tools, threats and techniques and keep your skills current.

\* Ability to write production-quality software as part of a team in at least one real programming language (JavaScript, Python or Go) for cloud deployment.

You don't need to meet every qualification on day one. If you're a strong engineer with the right instincts and you're excited to grow into the rest, we'd still like to hear from you.

Bonus points if you also:

\* Detection engineering and/or SIEM build-out experience.

\* A front-line SOC or incident-response background is a plus: you've done hands-on detection and response and now want to automate and scale it rather than do manual triage.

\* Familiarity with secure-development tooling (SAST, DAST, SCA, secrets scanning) and core concepts such as OWASP and threat modelling.

\* Hands-on experience implementing controls or running audits, and automating compliance evidence (e.g. with a GRC platform such as Vanta).

\* Distributed / large-scale systems experience.

\* Bug-bounty experience; contributions to the open-source or security community (CVEs, talks).

\* Understanding of SaaS and cloud-native business models.

WHAT MAKES THIS ROLE UNIQUE