Information Security Engineer

Description

The company is the company, an exposure management company. More than 40,000 organizations worldwide use its products to understand and reduce cyber risk, and its employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies.

The InfoSec team is hiring a security engineer for its Security Engineering and Architecture group. The role is intentionally broad: you split your time between securing cloud environments and supporting general security engineering work across the business, for both cloud and non-cloud systems. It suits early-career people who want exposure to many areas of InfoSec rather than depth in one.

The team describes itself as collaborative, with a focus on building best-in-class cybersecurity products for customers and on respect and belonging. You would work alongside experienced people and have the resources to do meaningful work.

Responsibilities

• Help run day-to-day cloud security work: monitor findings in AWS, Azure, and/or GCP through CNAPP or CSPM tools, triage them, and drive remediation.
• Learn the security architecture review process by supporting reviews of new systems, integrations, and vendor onboarding, whether cloud-hosted, on-prem, or SaaS. Over time you will take reviews from intake to sign-off.
• Find and record misconfigurations, excessive permissions, and insecure IaC (Terraform or CloudFormation), then track fixes until they close.
• Take part in risk assessments and threat modeling for new projects, including cloud workloads, internal applications, and third-party integrations.
• Support IAM and RBAC reviews and least-privilege work. Flag static credentials, overly broad roles, and gaps in audit logging wherever you find them.
• Build a working understanding of AI and agentic systems in our environment, including cloud LLM services (AWS Bedrock, Azure OpenAI, GCP Vertex AI), the Model Context Protocol (MCP), and the risks of agents that call tools. Apply this during reviews when such systems are in scope.
• Coordinate with engineering, GRC, and TPRM to keep architecture reviews and cloud findings moving. You will connect teams rather than work in isolation.

Requirements

• 2 to 3 years of experience in security engineering, cloud security, IT security, or a related technical role. Internships and adjacent IT or operations work count.
• Working knowledge of at least one major cloud provider (AWS, Azure, or GCP), including IAM basics, networking basics, and common misconfigurations.
• Basic knowledge of security architecture review or threat modeling, such as STRIDE or data flow diagrams, or a clear interest in learning them.
• Familiarity with least-privilege access, audit logging, secrets management with no static credentials, and secure configuration baselines.
• Comfort reading documentation and asking good questions about unfamiliar systems. Curiosity matters more than deep specialization here.
• Strong written communication, since you will document review findings and cloud remediation guidance for both technical and non-technical readers.
• Ideally, you also have: exposure to IaC security scanning (Terraform or CloudFormation) or CNAPP, CSPM, or CIEM platforms; informal experience reviewing a system design for security gaps; basic familiarity with AI and LLM concepts such as prompts, context windows, tool calling, and RAG, plus awareness of the OWASP Top 10 for LLM Applications or NIST AI RMF; a relevant certification such as Security+ or a cloud security certification, or equivalent self-directed learning; prior exposure to SOC 2, FedRAMP, or ISO 27001 relevant to architecture review sign-off.

Conditions

Hybrid work, with the location code LI-Hybrid LI-MS1.

Base pay range for US roles is $102,500 to $136,500 USD. Final pay depends on qualifications, skills, competencies, location, and experience, and may fall outside this range.

Employees may also receive variable pay: commission for sales roles or a bonus for non-sales roles, based on company and individual performance.

The company is an equal opportunity employer and does not discriminate on protected grounds. Data privacy notices may apply depending on your location.

Benefits

• Medical, dental, vision, disability, and life insurance.
• 401(k) with company match, an employee stock purchase plan, and flexible spending accounts.
• Employee referral program, Employee Assistance Program, education assistance, parental leave, paid time off, company-paid holidays, health and wellness events, and community programs.