InfoSec Engineer: ISO 27001 & App Security Lead

Bright Machines; Región Centro; On-site; MXN 1,200,000 - 1,800,000; Full time

Job summary

Bright Machines is seeking a senior security leader to run day-to-day information security across corporate, product, and manufacturing environments. You will own ISO 27001:2022 maintenance, complete security questionnaires, and drive secure SDLC practices with Platform Engineering and IT teams.

This role reports to the Global IT Director, requires strong English communication, and hands-on experience with SAST/DAST/SCA tools, IAM, incident response, and vulnerability management.

Qualifications

• 5+ years in security engineering, IT security, or related field.
• Experience maintaining ISO 27001 ISMS with audits.
• Hands-on with secure SDLC and application security basics (OWASP).
• Proficient scripting (Python) and infrastructure-as-code tooling.

Responsibilities

• Execute day-to-day information security operations across IT, platform, and product environments.
• Maintain ISO 27001:2022 certification including audits and surveillance.
• Handle customer security due diligence, questionnaires, audits, and contractual security requirements.
• Collaborate with Platform Engineering to embed security into the SDLC.
• Lead vulnerability management and coordinate remediation with engineering teams.
• Coordinate third-party security assessments and pen-tests.
• Support identity and access governance and incident response.
• Track security posture and compliance, reporting to the Global IT Director.
• Prepare for future compliance initiatives (e.g., SOC 2 Type II).

Skills

Security engineering

ISO 27001 ISMS

Application security

SAST/DAST/SCA tooling

Python scripting

Infrastructure as code

GRC platforms

Cloud security (AWS/Azure/GCP)

Security operations

English communication

Tools

Snyk

Semgrep

Checkmarx

Burp Suite

Job description

Bright Machines is seeking a senior security leader to run day-to-day information security across corporate, product, and manufacturing environments. You will own ISO 27001:2022 maintenance, complete security questionnaires, and drive secure SDLC practices with Platform Engineering and IT teams.

This role reports to the Global IT Director, requires strong English communication, and hands-on experience with SAST/DAST/SCA tools, IAM, incident response, and vulnerability management.