InfoSec Engineer - ISO 27001 & AppSec Champion

Bright Machines, Inc.; Guadalajara; On-site; MXN 900,000 - 1,300,000; Full time

Job summary

Bright Machines is seeking an experienced security professional to run day-to-day information security operations across corporate IT, platform, and product environments. You will help maintain ISO 27001:2022, manage due diligence for customers, and collaborate with Legal and Sales on security requirements.

You’ll partner with Platform Engineering, Software Development, and Delivery teams to embed security into the SDLC, manage vulnerabilities, and coordinate third-party assessments.

Qualifications

• 5+ years in security engineering, IT security, or related roles.
• Experience maintaining ISO 27001 ISMS with audits and surveillance.
• Hands-on experience with SAST/DAST/SCA tooling (Snyk, Semgrep, Checkmarx, Burp Suite).
• Proficiency in scripting (e.g., Python) for security automation; IaC tooling like Terraform/Ansible.

Responsibilities

• Execute day-to-day information security operations across corporate IT, platform, and product environments, in partnership with the Global IT Director.
• Maintain ISO 27001:2022 certification: collect evidence, perform internal audits, support surveillance and recertification.
• Handle customer security due diligence, questionnaires (SIG, CAIQ), audits, and track contractual security requirements with Legal and Sales.
• Partner with Platform Engineering to integrate application security into the SDLC: threat modeling, secure code review guidance, and SCA tooling operation.
• Run vulnerability management across applications and platform infrastructure: scanning, triage, and remediation with engineering teams to SLA.
• Coordinate third-party penetration tests and security assessments; track findings to closure.
• Support security posture of network and compute infra with EDR/SOC and IDS/IPS controls; align with network security architecture.
• Assist security incident response: maintain IR plan, participate in investigations, run tabletop exercises.
• Support identity and access governance (MFA/SSO, access reviews) with IT Engineering.
• Conduct security risk assessments for new vendors/tools and third-party integrations.
• Maintain information security policies, standards, and employee awareness training.

Skills

Security engineering

IT security

Application security

Tools

Snyk

Semgrep

Checkmarx

Burp Suite

Terraform

Ansible

Job description

Bright Machines is seeking an experienced security professional to run day-to-day information security operations across corporate IT, platform, and product environments. You will help maintain ISO 27001:2022, manage due diligence for customers, and collaborate with Legal and Sales on security requirements.

You’ll partner with Platform Engineering, Software Development, and Delivery teams to embed security into the SDLC, manage vulnerabilities, and coordinate third-party assessments.