Lead Security Engineer - Remote, Secure Architect

Circles; United States; On-site; USD 140,000 - 210,000; Full time

Job summary

Circles is seeking a hands-on Lead Security Engineer to strengthen security across applications, APIs, cloud infra, and engineering platforms. You will own secure architecture, application security, penetration testing, SOC incident response, and security automation—partnering with Engineering, DevOps, and Product to bake security into the SDLC.

The ideal candidate has 10–12 years of experience, deep knowledge of OWASP Top 10/API Security Top 10, and strong cross-functional collaboration skills

Qualifications

• 10-12 years of hands-on experience in Application Security and Security Engineering.
• Strong knowledge of threat modeling and secure architecture reviews.
• Proficiency in microservice architecture, pen testing, and vulnerability management.
• Experience with SAST, DAST, SCA, containers, and IaC.
• Familiarity with cloud security, CI/CD, and DevSecOps practices.
• Proficiency in Python scripting for security automation.

Responsibilities

• Lead threat modeling (STRIDE/PASTA) for new apps and platform changes.
• Oversee secure architecture reviews for apps, APIs, cloud infra, and third parties.
• Own the App & API Security program end-to-end: SAST/DAST/SCA and API testing.
• Drive secure design patterns and reference architectures across the SDLC.
• Plan and execute internal and external pen tests; manage remediation SLAs.
• Lead incident response and SOC activities; tune SIEM/SOAR for better detection.

Skills

Threat modeling

Secure architecture

Microservice security

Penetration testing

Vulnerability management

SAST

DAST

SCA

APIs security

Containers security

Kubernetes

Cloud security

DevSecOps

Python scripting

Security automation

SIEM/SOAR

Incident response

Communication

Tools

SAST

DAST

SCA

Kubernetes

Terraform

Job description

Circles is seeking a hands-on Lead Security Engineer to strengthen security across applications, APIs, cloud infra, and engineering platforms. You will own secure architecture, application security, penetration testing, SOC incident response, and security automation—partnering with Engineering, DevOps, and Product to bake security into the SDLC.

The ideal candidate has 10–12 years of experience, deep knowledge of OWASP Top 10/API Security Top 10, and strong cross-functional collaboration skills