Security Engineer: ISO 27001 & AppSec Focus

Bright Machines, Inc.; Burlingame (CA); On-site; USD 170,000 - 200,000; Full time

Job summary

Bright Machines, Inc. is seeking an IT security leader to run day-to-day information security across corporate, product, and manufacturing environments. The Global IT Director sets policy while you execute controls and maintain the ISO 27001:2022 certification.

You will collaborate with Infrastructure, Platform Engineering, and Delivery teams, manage audits, and drive risk management. Excellent English communication is essential for cross‑functional work.

Qualifications

• 5+ years of experience in security engineering, IT security, or related role.
• Experience maintaining ISO 27001 ISMS with evidence collection and audits.
• Hands-on experience with OWASP Top 10 and secure SDLC practices; use of SAST/DAST/SCA tooling.

Responsibilities

• Execute day-to-day information security operations across IT, platform, and product environments.
• Maintain ISO 27001:2022 certification; manage evidence, audits, and corrective actions.
• Handle customer security questionnaires (SIG/CAIQ) and support audits with Legal and Sales.
• Integrate security into the SDLC with threat modeling, secure code guidance, and tool operation.
• Run vulnerability management across applications and infrastructure; drive remediation with engineers to SLA.
• Coordinate third-party penetration tests and security assessments; track findings to closure.
• Collaborate with Infrastructure Engineer on network and compute security posture; align with security controls.
• Support incident response planning, investigations, and tabletop exercises.
• Assist in identity and access governance (MFA/SSO, access reviews).
• Conduct security risk assessments for vendors and integrations.
• Maintain security policies and awareness programs; report posture to Global IT Director.
• Prepare for future compliance initiatives (e.g., SOC 2 Type II).

Skills

Security engineering

ISO 27001 ISMS

OWASP Top 10

Python scripting

Terraform/Ansible

SAST/DAST/SCA tooling

GRC platforms

Cloud security

Customer security conversations

EDR/managed SOC

English communication

Security incident response

Tools

Snyk

Semgrep

Checkmarx

Burp Suite

Job description

Bright Machines, Inc. is seeking an IT security leader to run day-to-day information security across corporate, product, and manufacturing environments. The Global IT Director sets policy while you execute controls and maintain the ISO 27001:2022 certification.

You will collaborate with Infrastructure, Platform Engineering, and Delivery teams, manage audits, and drive risk management. Excellent English communication is essential for cross‑functional work.