Information Security Solutions Engineer II

Leith of Wendell; United States; In loco; USD 120.000 - 160.000; Tempo pieno

Descrizione del lavoro

Holman is seeking a Security Engineer where cloud infrastructure and software development meet. You will design security architecture for Azure and AWS, maintain security tooling, and collaborate with development teams to threat model applications and remediate vulnerabilities.

You will also review third-party vendor security, support AI security initiatives, and participate in incident response as part of the security team. Strong emphasis on IaC and secure SDLC practices.

Competenze

• 5-7 years in information security and engineering, with cloud/security focus.
• Strong experience securing Azure and AWS in cloud-native and hybrid setups.
• Hands-on with Terraform/Terragrunt/ARM/Bicep.
• Ability to read code in .NET, Python, Ruby, or Node.js to explain vulnerabilities and fixes.
• Knowledge of OWASP Top 10 and threat modeling methodologies (STRIDE).
• Experience with Entra ID and AWS IAM, least-privilege RBAC.

Mansioni

• Review cloud security solutions and contribute to secure architecture designs for Azure and AWS.
• Build, deploy, and maintain security infrastructure as code (Terraform, Terragrunt, ARM, Bicep).
• Perform third-party vendor security reviews and document findings with mitigations.
• Conduct threat modeling with development teams and support remediation.
• Support security of AI platforms and governance, including prompts and data handling.
• Participate in incident response and share security best practices.

Conoscenze

Cloud security

Application security

Threat modeling

Terraform

ARM/Bicep

Azure

AWS

OWASP Top 10

OAuth2/OpenID

Code review

Strumenti

Wiz

Prisma Cloud

Descrizione del lavoro

Holman is a family-owned, global automotive services organization anchored by our deeply rooted core values and principles that have enabled us to continue Driving What's Right throughout the last century. Our teams deliver the Holman Experience by treating our customers and each other as we would like to be treated, and creating positive, rewarding relationships all around.

The automotive markets Holman serves include fleet management and leasing; vehicle fabrication and upfitting; component manufacturing and productivity solutions; powertrain distribution and logistics services; commercial and personal insurance and risk management; and retail automotive sales as one of the largest privately owned dealership groups in the United States.

Holman is looking for a Security Engineer to work where cloud infrastructure and software development meet. You will review and design security architecture for our cloud environments, maintain our application security tooling, and work directly with development teams to threat model applications and find and fix vulnerabilities. You will also perform third-party vendor security reviews, support our work with external penetration testing partners, help secure our growing use of AI, and take part in incident response as part of the broader security team.

Principal Purpose of Position

Security Engineering

• Review cloud security solutions and contribute to secure architecture designs for Azure and AWS environments, turning business requirements into practical security controls.
• Provide security architecture guidance and design patterns to Infrastructure, Cloud, and Development teams.
• Build, deploy, and maintain security infrastructure as code with Terraform, Terragrunt, ARM, and Bicep, so that controls stay consistent, version-controlled, and repeatable.
• Perform third-party vendor security reviews: assess vendor architecture, controls, and risk, document findings, and recommend mitigations or acceptance criteria.
• Contribute to the security architecture and operation of enterprise AI platforms, including MCP gateways, LLM routers, and AI gateways. This covers access control and tool permissions, prompt injection and data leakage risks, AI usage and cost governance (FinOps), and observability and logging of AI activity.
• Keep documentation of security controls, configurations, architecture decisions, and procedures accurate and current.

Software Security

• Perform threat modeling with development teams on new and existing applications, and work with developers to understand vulnerabilities and architectural security issues, supporting remediation through to verified closure.
• Support the IAM team on cloud and application identity security, including workload and managed identities, service principals, least-privilege role design, secrets handling, and application authentication and authorization patterns.
• Administer and maintain application and cloud security tooling, including cloud security posture, runtime application security, and API security testing platforms. This covers configuration, tuning, integrations, and keeping findings accurate.
• Help integrate security controls and testing into CI/CD pipelines and developer workflows.
• Work with third-party penetration testing providers to support scoping, ongoing attack surface assessment, results triage, and remediation tracking.
• Report vulnerability exposure, remediation status, and risk to application owners and management.

Incident Response & General

• Participate in incident response activities, contributing cloud and application security expertise to investigation, containment, and remediation.
• Lead specific initiatives or workstreams when delegated.
• Share knowledge with peers and developers on secure design and coding practices.
• Stay current on cloud and application threats, attack techniques, and security technologies, and recommend improvements to Holman's security posture.
• Perform other duties and special projects as assigned.

Relevant Work Experience

• 5-7 years of combined information security and technical engineering experience, with significant time in cloud security, application security, or both.
• Strong experience securing Microsoft Azure and Amazon AWS environments in cloud-native and hybrid architectures.
• Hands-on experience writing and maintaining infrastructure as code with Terraform (Terragrunt a plus), ARM, and/or Bicep.
• Ability to read and reason about application code in at least one of .NET, Python, Ruby, or Node.js, well enough to explain a vulnerability and its fix to a developer.
• Strong working knowledge of OWASP Top 10, OWASP API Security Top 10, threat modeling methodologies (e.g., STRIDE), and secure software development practices.
• Working knowledge of cloud and application identity: Entra ID and AWS IAM, managed identities and service principals, RBAC and least privilege, and OAuth 2.0/OpenID Connect.
• Experience operating application and cloud security tooling, such as CNAPP/CSPM (e.g., Wiz, Prisma Clo