Cybersecurity Engineer

Aicente; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Remote role across United States

Home-office stipend

Hubs in MA and NH

Job summary

Aicente is seeking a security-focused lead to own application and platform security for a web product with payments, authentication, and highly sensitive data. You will drive threat modeling, design reviews, controls, monitoring, incident response, and runbooks, while keeping security aligned with product evolution.

Required: 4+ years in app security, strong OWASP knowledge, cloud experience (AWS/GCP), and ability to read code; TypeScript/Node.js is a plus.

Qualifications

• 4+ years in application security, product security, or security engineering.
• Deep knowledge of web application security including OWASP risks and authentication systems.
• Experience securing cloud environments such as AWS or GCP.
• Ability to read and write code; TypeScript or Node.js experience is useful.
• Methodical incident handling and clear written communication.

Responsibilities

• Threat-model new features and review changes for authorization flaws, injection risks, SSRF, and secret exposure.
• Strengthen authentication and authorization, including token and API key handling and rate limits.
• Improve cloud and platform protections through least-privilege access, secret management, and dependency and container scanning.
• Develop monitoring and alerts to detect suspicious activity and abuse.
• Lead incident response and document repeatable procedures in runbooks.
• Maintain security reviews for sensitive payment and email-sending paths.

Skills

OWASP knowledge

Authentication systems

Cloud security AWS/GCP

TypeScript/Node.js

Incident handling

Clear written communication

Tools

AWS

GCP

Job description

Role overview

Lead application and platform security for a web product with payment flows, authentication, and sensitive business data. The work spans design reviews, security controls, monitoring, and incident response, with a focus on preventing vulnerabilities as the product changes.

Responsibilities

• Threat-model new features and review application changes for authorization flaws, injection risks, SSRF, and secret exposure.
• Strengthen authentication and authorization, including token and API key handling and rate limits.
• Improve cloud and platform protections through least-privilege access, secret management, and dependency and container scanning.
• Develop monitoring and alerts to detect suspicious activity and abuse.
• Lead incident response and document repeatable procedures in runbooks.
• Maintain security reviews for sensitive payment and email-sending paths.

Requirements

• At least four years in application security, product security, or security engineering.
• Strong web application security knowledge, including OWASP risks and authentication systems.
• Experience securing cloud environments such as GCP or AWS.
• Ability to read and write code; TypeScript or Node.js experience is useful.
• Methodical incident handling and clear written communication.

Benefits and work setup

• Remote role within the United States, with a home-office stipend and hubs in Massachusetts and New Hampshire.
• Medical, dental, and vision coverage, plus a wellness stipend.
• Annual budget for learning, including conferences, courses, and books, and access to mentorship.
• Flexible paid time off, including a required minimum.