First Security Engineer: Build Scalable Security Program

Invictus Direct; San Francisco (CA); On-site; USD 100,000 - 200,000; Full time

Benefits offered by this job

Relocation assistance

Visa sponsorship

Job summary

Invictus Direct is seeking its first full-time Security Engineer to own and build the security program across product, cloud, and internal systems. This hands-on IC role includes incident response, compliance, and customer trust, with a focus on rapid security maturation for a scaling data company.

You'll harden AWS, establish monitoring and SOC 2 controls, and drive threat modeling, code reviews, and vulnerability management across the stack, reporting directly to leadership.

Qualifications

• 5–10 years of hands-on security experience across offensive security, infrastructure/cloud security, application security, and incident response.
• Experience building a security program from zero at a fast-growing startup.
• Strong AWS and cloud-engineering depth, including infrastructure as code with Terraform.
• Experience implementing or operating SOC 2 or a comparable security framework.
• Sound judgment to prioritize risks in a fast-moving environment.

Responsibilities

• Own the security roadmap across product, cloud and infrastructure, corporate systems, incident response, and compliance.
• Harden AWS infrastructure and accounts, including IAM, networking, logging, Terraform, secrets management, and automated guardrails.
• Establish monitoring, SIEM/XDR, detection engineering, alerting, and incident-response workflows to stop problems before incidents.
• Secure applications, APIs, the platform, and data workflows through threat modeling, code reviews, vulnerability research, and access controls.
• Improve container/workload isolation for untrusted code or sensitive data.
• Own abuse, fraud, and incident response end-to-end, including containment, investigation, postmortems, and follow-up engineering.
• Build continuous attack-surface management across domains, cloud services, vendors, and exposed assets.
• Complete SOC 2 and own customer trust work, including policy management and audits.
• Translate data-license requirements into enforceable controls for access, retention, and auditability.

Skills

Offensive security

Cloud security

SOC 2

Terraform

Incident response

Vulnerability research

App security

AWS security

Tools

AWS

Terraform

SIEM/XDR

Vulnerability scanners

Job description

Invictus Direct is seeking its first full-time Security Engineer to own and build the security program across product, cloud, and internal systems. This hands-on IC role includes incident response, compliance, and customer trust, with a focus on rapid security maturation for a scaling data company.

You'll harden AWS, establish monitoring and SOC 2 controls, and drive threat modeling, code reviews, and vulnerability management across the stack, reporting directly to leadership.