Security Engineer.

WHAT YOU WILL BE DOING

• Execute day-to-day information security operations across corporate IT, platform, and product environments, in partnership with the Global IT Director, who sets security policy and strategy.

• Maintain our existing ISO 27001:2022 certification: manage evidence collection, internal audits, and corrective actions, and support annual surveillance and recertification audits.

• Execute customer security due diligence, completing security questionnaires (SIG, CAIQ), supporting customer audits, and tracking contractual security requirements, partnering with Legal and Sales as needed.

• Partner with Platform Engineering to build application security into the SDLC: threat modeling support, secure code review guidance, and operation of SAST/DAST/SCA tooling.

• Run vulnerability management across applications and platform infrastructure: scanning, triage, and driving remediation with engineering teams to SLA.

• Coordinate third-party penetration tests and security assessments; track findings to closure.

• Partner with the Infrastructure Engineer on the security posture of network and compute infrastructure, including our EDR/managed SOC and network IDS/IPS controls, keeping application and platform controls aligned with network security architecture.

• Support security incident response: help maintain the IR plan, participate in investigations, and run periodic tabletop exercises.

• Support identity and access governance for corporate and platform systems (access reviews, certifications, MFA/SSO enforcement) with IT Engineering.

• Conduct security risk assessments for new vendors, tools, and third-party integrations.

• Maintain information security policies, standards, and employee security awareness training (including phishing simulations), in line with direction from the Global IT Director.

• Track and report on security posture, risk, and compliance status to the Global IT Director.

• Help evaluate and prepare for future compliance initiatives (e.g., SOC 2 Type II) as prioritized by leadership.

WHAT WE WANT TO SEE

• 5+ years of experience in security engineering, IT security, application security, or a closely related role.

• Experience maintaining an existing ISO 27001 ISMS: evidence collection, internal audits, and support for surveillance/recertification audits. (Building an ISMS from scratch isn't required; we already hold certification.)

• Working knowledge of application security fundamentals (OWASP Top 10, secure SDLC practices) with hands-on experience using SAST/DAST/SCA tooling (e.g., Snyk, Semgrep, Checkmarx, Burp Suite).

• Proficiency in a scripting language (e.g., Python) for security automation, with a strong inclination toward infrastructure-as-code (e.g., Terraform, Ansible) for codifying and enforcing security controls.

• Familiarity with GRC platforms for compliance evidence and monitoring.

• Basic cloud security literacy (AWS, Azure, and/or GCP): IAM, network security groups, encryption, logging and monitoring.

• Comfortable completing customer security questionnaires and supporting customer-facing security conversations under direction.

• Familiarity with EDR/managed SOC platforms and comfort participating in security operations and detection/response workflows.

• Excellent written and verbal English communication skills, with the ability to communicate clearly with IT, Platform Engineering, Software Development, and Delivery stakeholders.

• Comfortable as an execution-focused security practitioner in a lean IT organization, partnering closely with the Global IT Director, Infrastructure Engineer, Platform Engineering, and staff IT Engineers rather than working in isolation.

IT WOULD BE GREAT IF YOU HAD

• Security certifications such as Security+, GSEC, or CCSP.

• Experience in manufacturing, industrial, IoT, or OT/ICS security environments.

• Exposure to penetration testing engagements, hands-on or coordinating with external testers.

• Familiarity with Zero Trust architecture principles.

• English language proficiency.

BE EMPOWERED TO CHANGE AN INDUSTRY