Security Engineer

MaC VC; San Francisco (CA); Presencial; USD 140.000 - 230.000; Jornada completa

Descripción de la vacante

MaC VC seeks to own security for Avala's platform, enforcing SOC 2 Type II and driving security across application and infrastructure. You will partner with engineering to embed secure practices in the development lifecycle and lead audits for customer trust.

The role focuses on building monitoring, testing, and governance to protect data in transit and at rest, with a strong emphasis on risk reduction and scalable security controls.

Formación

• 4+ years in application or infrastructure security or security engineering.
• Experience with SOC 2, ISO 27001, or FedRAMP frameworks.
• Strong knowledge of AWS security services and best practices.
• Experience with security testing methods and tooling.
• Understanding of web application security (OWASP Top 10).

Responsabilidades

• Lead SOC 2 Type II compliance and security audit programs.
• Perform application security reviews and penetration testing.
• Design and implement infrastructure security controls across AWS (ECS, Aurora, S3).
• Build security monitoring, alerting, and incident response procedures.
• Evaluate and mitigate security risks in customer data handling workflows.
• Work with engineering teams to embed security into the development lifecycle.

Conocimientos

Application security

Security auditing

Penetration testing

AWS security

OWASP Top 10

Security architecture

Herramientas

SAST/DAST tools

Vulnerability management

Descripción del empleo

Own security for Avala's platform — from SOC 2 compliance to application security to infrastructure hardening. Our enterprise customers in autonomous vehicles and defense demand the highest security standards, and you'll ensure we exceed them.

What You’ll Do:

• Lead SOC 2 Type II compliance and security audit programs
• Perform application security reviews and penetration testing
• Design and implement infrastructure security controls across AWS (ECS, Aurora, S3)
• Build security monitoring, alerting, and incident response procedures
• Evaluate and mitigate security risks in customer data handling workflows
• Work with engineering teams to embed security into the development lifecycle

Requirements:

• 4+ years in application security, infrastructure security, or security engineering
• Experience with SOC 2, ISO 27001, or FedRAMP compliance frameworks
• Strong knowledge of AWS security services and best practices
• Experience with SAST/DAST tools, vulnerability management, and pen testing
• Understanding of web application security (OWASP Top 10)

Nice to Have:

• CISSP, OSCP, or similar security certification
• Experience with defense/government security requirements (ITAR, CMMC)
• Background in securing ML or data pipeline infrastructure