IND - Senior Information Security Engineer

IRIS; United States; Remote; USD 120.000 - 190.000; Vollzeit

Benefits dieser Stelle

Drop transport for women colleagues

Zusammenfassung

IRIS Software Group is seeking a Senior Information Security Engineer - Vulnerability Management to own the end-to-end lifecycle from identification to remediation across products and platforms. You will triage findings from SAST, DAST, SCA and secrets scans, and collaborate with Engineering and Product teams to drive timely remediation.

You will also help integrate security tooling into CI/CD pipelines, develop risk-based prioritisation, and strengthen cloud security across AWS/Azure while

Qualifikationen

• Experience with application security, vulnerability management, and security tooling.
• Ability to assess risk beyond scanner output and context.
• Cloud security across AWS and/or Azure with secure configurations.

Aufgaben

• Own the end-to-end vulnerability management lifecycle across our products and supporting technology, from identification and validation through prioritisation, remediation tracking, risk acceptance and reporting.
• Triage and validate findings from SAST, DAST, SCA, secrets scanning, penetration testing and web application scanning.
• Work closely with Engineering and Product teams to drive remediation of vulnerabilities and align on remediation timelines.
• Partner with teams integrating security tooling into CI/CD pipelines to improve coverage and effectiveness.
• Develop risk-based vulnerability prioritisation considering exploitability, asset exposure and business criticality.
• Identify recurring vulnerability patterns and root causes to reduce systemic weaknesses.
• Continuously improve vulnerability management processes, dashboards and workflows for scalability.
• Support security review of software supply chain risks including dependency management and secure build practices.
• Review findings from cloud security and CSPM platforms to prioritise and remediate cloud vulnerabilities.
• Research emerging cloud threats and mitigations and implement appropriate controls.

Kenntnisse

Application security

Vulnerability management

Software engineering

CI/CD security

SAST

DAST

SCA

Secrets scanning

Cloud security

AWS/Azure

Tools

SAST

DAST

SCA

Secrets scanning

CI/CD pipelines

Jobbeschreibung

About IRIS

IRIS Software Group is one of the UK's largest privately held software companies, trusted by 100,000+ businesses, schools and accountancy firms to keep their operations running. Our software pays 1 in 6 UK employees, supports over 12,000 schools, and is relied on by 91 of the top 100 UK accountancy firms.

We're a Great Place to Work certified employer, recognised for our commitment to well-being, inclusion and development - and we're growing fast.

Hello Eveyone,

I am writing this Job Post to brief about the job opportunity with IRIS KPO Resourcing Pvt Ltd (IRIS Software Group) for Senior information security Engineer - Vulnerability Management

Shift timing : UK Business Hours (2:00 PM - 11:00 PM IST)

Web Link : https://www.iris.co.uk/

Location : Remote (Work From Home)

One way (Drop) Transport will be provided for the women colleagues.

Employment Type : Full-Time | Permanent

Desired Candidate

You bring a strong technical background in application security, vulnerability management or software engineering, with a clear understanding of how vulnerabilities arise and how they should be remediated. Practical experience with security tooling such as SAST, DAST, SCA and secrets scanning matters here, ideally integrated into modern CI/CD environments. Just as valuable is the judgement to assess vulnerabilities in context, weighing exploitability, internet exposure, asset criticality, available exploits and compensating controls rather than taking scanner output at face value. You are also comfortable with software supply chain security, including frameworks such as SLSA, dependency security and secure build pipelines.

Your background includes a solid grounding in public cloud security, particularly across AWS and/or Azure. You recognise the vulnerabilities that recur in cloud environments, from overly permissive identities and exposed services to insecure storage, vulnerable workloads and configuration drift.

What you will do

• Own the end-to-end vulnerability management lifecycle across our products and supporting technology, from identification and validation through prioritisation, remediation tracking, risk acceptance and reporting.
• Triage and validate findings from multiple sources, including SAST, DAST, SCA, secrets scanning, penetration testing and web application scanning.
• Work closely with Engineering and Product teams to drive remediation of vulnerabilities, helping teams understand technical risk, agree appropriate remediation actions and meet defined remediation timelines.
• Partner with teams responsible for integrating security tooling into our CI/CD pipelines, helping improve the quality, coverage and effectiveness of that tooling.
• Develop and continuously improve risk-based vulnerability prioritisation, considering exploitability, asset exposure, business criticality, threat intelligence and compensating controls rather than relying solely on scanner severity.
• Identify recurring vulnerability patterns and root causes, working with engineering teams to reduce systemic weaknesses rather than repeatedly fixing individual findings.
• Continuously improve vulnerability management processes, dashboards and workflows, bringing strong technical ownership and ideas for making the programme more scalable and effective.
• Support the security review of software supply chain risks, including dependency management, build pipeline security and relevant secure software development practices.
• Review and validate findings from cloud security and CSPM platforms, helping Infrastructure and Engineering teams prioritise and remediate cloud vulnerabilities and configuration weaknesses.
• Research emerging cloud threats, vulnerabilities and misconfiguration patterns and recommend appropriate mitigations.
• Support the implementation and improvement of cloud security controls and security baselines where required.

Why You'll Love Working Here

• Impact: Your work will influence millions globally.

• Growth: Continuous learning and career development opportunities.

• Belonging: A culture that celebrates diversity and empowers every individual.

What to expect from our hiring process

Our process is designed to be fair, transparent and straightforward. Stages vary depending on the role — more senior positions may involve additional steps, and some areas include role-specific assessments such as a technical test or case study — but typically you can expect:

1. Application review — we assess your experience and potential

2. Initial call — a short conversation to learn about you and share more about the role

3. Skills assessment — tailored to the position, e.g. case study, coding challenge or portfolio review

4. Final interview — meet the team and explore how you’ll make an IMPACT at IRIS

We'll always walk you through the specific stages at the start of the process so you can prepare with confidence.

If you need any adjustments or accommodations during the process, let us know, we're committed to making this experience accessible for everyone.