Security Engineer

Описание вакансии

*😎 Security Engineer*

Project-based

Part-time employment

*❇️ About the role*

Quantum One builds AI-powered SaaS platforms for enterprise clients across the MENA region - including organizations in finance, government, and other sectors with stringent security and regulatory requirements. Our products must be secure by design, our clients run their own security due diligence, audits, and penetration tests before and during every engagement.

We’re looking for a Security Engineer to own the security posture of our products end to end - from architecture review at design stage to vulnerability management in production - and to represent our security practice in front of demanding client security teams.

*❇️ What you’ll do:*

• Conduct security architecture reviews and threat modeling for new features, services, and client deployments (multi-tenant SaaS, LLM/RAG pipelines, third-party integrations)
• Perform vulnerability assessments of our applications and cloud infrastructure (AWS, Azure); triage findings, drive remediation with engineering teams within defined SLAs, and verify fixes
• Own the SDLC security toolchain: SAST/DAST, dependency and container scanning, secrets detection, IaC scanning - integrated into CI/CD with sensible blocking policies
• Review and harden authentication, authorization, and tenant-isolation designs; define secure-by-default patterns for product teams
• Assess security of the AI/LLM layer: prompt injection, cross-tenant data leakage, model supply chain, agent tool-use boundaries
• Act as the security point of contact for enterprise clients: complete security questionnaires, lead architecture walkthroughs, and defend our design decisions in front of client security and compliance teams
• Prepare deployments for high-security environments: hardening baselines, data residency requirements, network isolation, customer-managed keys, deployment into client-controlled cloud or private environments where required
• Coordinate and support external penetration tests and client-initiated audits; own remediation of findings and formal responses
• Translate client-specific security requirements (regulatory, contractual) into engineering requirements and verify their implementation

*❇️ What we’re looking for:*

• 4+ years in application security, product security, or security engineering for SaaS products
• Practical experience with threat modeling (STRIDE or similar) and secure architecture review - you can read a design doc and find the holes
• Hands-on cloud security experience on AWS and/or Azure: IAM, network segmentation, encryption and key management, logging/monitoring
• Experience running SAST/DAST/SCA tooling in CI/CD (e.g., Semgrep, Trivy, Snyk) and tuning it so developers don’t route around it
• Track record of working with enterprise or regulated clients: security questionnaires, audits, pentest coordination, or vendor security assessments

*📥 Please send your CV to Ivan Belov,* Откликнуться