Security Assurance Engineer

Bayside Solutions; Seattle (WA); On-site; USD 120,000 - 190,000; Full time

Job summary

Bayside Solutions in Seattle seeks a hands-on Security Assurance Engineer to evaluate and improve security controls across applications, cloud services, and enterprise tech. You will partner with engineering and security stakeholders to identify gaps, document risk, drive remediation, and provide clear evidence that controls operate as intended.

The role emphasizes practical testing, threat modeling, and clear reporting.

Qualifications

• Experience in security assurance, product security, cloud security, or risk assessment.
• Evaluate security design and controls for modern distributed services and cloud-native systems.
• Ability to translate risks into engineering recommendations and verify remediation.

Responsibilities

• Perform risk-based security assessments of apps, APIs, cloud services, and infra.
• Validate security controls through technical reviews, evidence, and testing.
• Review architecture changes for threats and mitigation before deployment.
• Collaborate with developers, SRE, and product owners to triage findings and track remediation.
• Evaluate vulnerability management, secure config, logging, and data protection controls.
• Support SSDLC assurance, threat modeling, and security test result reviews.

Skills

Security risk assessment

Threat modeling

Cloud security

Kubernetes

Python scripting

Documentation

Tools

AWS

Azure

GCP

Kubernetes

Job description

We are seeking a hands-on Security Assurance Engineer to help evaluate, validate, and improve security controls across applications, cloud infrastructure, and enterprise technology services. The engineer will partner with engineering and security stakeholders to identify gaps, document risk, drive remediation, and produce clear evidence that controls operate as intended. This is an assurance and technical security role, not a dedicated identity and access management (IAM) position.

Duties and Responsibilities:

• Perform risk-based security assessments of applications, APIs, cloud services, infrastructure, and engineering workflows.
• Validate implementation and operating effectiveness of security controls through technical reviews, evidence collection, and repeatable testing.
• Review architecture and design changes; identify threats, control gaps, and practical mitigations before deployment.
• Partner with developers, SRE/platform teams, and product owners to triage findings, prioritize risk, track remediation, and verify closure.
• Evaluate vulnerability management practices, secure configuration, logging, monitoring, secrets handling, and data protection controls.
• Support secure software development lifecycle (SSDLC) assurance, including threat modeling and security test results review.
• Communicate findings in clear written assessments, actionable tickets, risk summaries, and stakeholder-ready reporting.

Requirements and Qualifications:

• Professional experience in security assurance, product/application security, cloud security, security engineering, or technical risk assessment.
• Ability to evaluate security design and controls for modern distributed services, APIs, Linux environments, and cloud-native systems.
• Hands-on knowledge of vulnerability classes, remediation validation, secure configurations, logging, and defense-in-depth principles.
• Working understanding of threat modeling and established security guidance such as OWASP, NIST CSF / SP 800-53, or CIS Benchmarks.
• Ability to turn ambiguous security risks into well-scoped engineering recommendations and verify technical remediation.
• Strong collaboration, technical writing, and communication across security, engineering, and program stakeholders.
• Familiarity with public cloud security (AWS, Azure, or GCP), containers, Kubernetes, and infrastructure as code.
• Experience interpreting SAST, DAST, dependency-scanning, container-scanning, or cloud posture findings.
• Python or another scripting language for evidence automation, control checks, or data analysis.
• Experience supporting audit/readiness work by mapping technical evidence to security control requirements.
• Relevant professional certifications (for example, CISSP, CCSP, GIAC, or cloud security certifications); not required.

Desired Skills and Experience

Security assurance, application and API security, cloud and infrastructure security, risk-based security assessments, security control testing and validation, evidence collection, security architecture reviews, threat modeling, risk prioritization, remediation tracking and verification, vulnerability management, secure configuration, logging and monitoring, secrets management, data protection, SSDLC, distributed systems, Linux, cloud-native security, defense in depth, OWASP, NIST CSF, NIST SP 800-53, CIS Benchmarks, AWS/Azure/GCP, containers, Kubernetes, infrastructure as code, SAST/DAST findings analysis, dependency and container scanning, cloud security posture assessment, Python/scripting, evidence automation, data analysis, audit readiness, control mapping, technical writing, stakeholder reporting, cross-functional collaboration, CISSP/CCSP/GIAC or cloud security certifications preferred

Bayside Solutions, Inc. is not able to sponsor any candidates at this time. Additionally, candidates for this position must qualify as a W2 candidate.