Cyber Security Engineer →

Nextlex; San Francisco, Northern (CA, KY); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Nextlex is seeking a security-focused professional to establish and maintain the platform's comprehensive security posture in a high-trust legal tech environment. This role emphasizes confidentiality, integrity, and availability of sensitive data across systems in San Francisco.

You will design controls across the SDLC, perform pentests and code reviews, manage IAM, and develop incident response documentation to support compliance with SOC 2 and ISO 27001.

Qualifications

• 4+ years of hands-on experience in application security, cloud security, or offensive/defensive cybersecurity roles.
• Strong proficiency with authentication protocols (OAuth, SAML) and modern encryption practices.
• Experience with security technologies such as SIEM, WAF, IDS/IPS, and automated security testing.
• Deep knowledge of OWASP Top 10 and secure software development practices.

Responsibilities

• Design and implement robust security controls across the full SDLC, including application, network, and infrastructure security.
• Conduct penetration tests, vulnerability assessments, and code reviews to identify and resolve security risks.
• Manage IAM systems and ensure compliance with data privacy frameworks such as SOC 2 and ISO 27001.
• Develop and maintain incident response plans and all related security documentation.

Skills

4+ years experience

OAuth

SAML

SIEM

WAF

IDS/IPS

OWASP Top 10

Tools

OAuth

SAML

SIEM

WAF

IDS/IPS

Job description

Establish and maintain the comprehensive security posture of the Nextlex platform, ensuring absolute confidentiality, integrity, and availability of sensitive legal and client data. This role is critical in supporting the high-trust environment required in legal technology.

Key Responsibilities

• Design and implement robust security controls across the full SDLC, including application, network, and infrastructure security.
• Conduct penetration tests, vulnerability assessments, and code reviews to identify and resolve security risks.
• Manage and monitor identity and access management (IAM) systems and ensure compliance with data privacy frameworks such as SOC 2 and ISO 27001.
• Develop and maintain incident response plans and all related security documentation.

Qualifications

• 4+ years of hands-on experience in application security, cloud security, or offensive/defensive cybersecurity roles.
• Strong proficiency with authentication protocols (OAuth, SAML) and modern encryption practices (data at rest and in transit).
• Experience with security technologies such as SIEM, WAF, IDS/IPS, and automated security testing.
• Deep knowledge of common web vulnerabilities and standards (OWASP Top 10).

Preferred Experience

• Security certifications (such as CISSP, OSCP, or CEH).
• Experience building or managing SOC 2 or other compliance programs.
• Familiarity securing AI/LLM pipelines and managing third-party risk.