Security Engineer (Remote)

RecruiterForge; United States; On-site; USD 100,000 - 170,000; Full time

Job summary

RecruiterForge is seeking a Security Engineer to protect digital assets, infrastructure, and applications through proactive vulnerability management, security engineering, and incident response. You will partner with engineering teams to strengthen controls, coordinate with leadership on incidents, and drive improvements across cloud, network, and code environments.

The role reports to the Staff DevOps Engineer and involves hands-on work with SAAS security and modern tooling, plus mentoring

Qualifications

• Bachelor's degree in Computer Science, Software Engineering, or a related technical field.
• At least 3 years of experience in security engineering, application security, or incident response.
• Hands-on experience with modern vulnerability, application testing, security monitoring, and observability tools.
• Strong understanding of OWASP Top 10, CWE, and cloud security best practices.
• Experience integrating security scanning and controls into CI/CD pipelines and build automation.
• Proficiency in Python and Bash scripting for security automation and tooling.

Responsibilities

• Monitor dependencies with Software Composition Analysis to identify supply chain risks and mitigate them.
• Track and prioritize CVEs affecting the technology stack and drive remediation.
• Partner with developers to automate dependency updates and integrate security scanning into CI/CD pipelines.
• Coordinate external penetration tests and bug bounty programs, and validate findings for remediation.

Skills

Mentoring

Security concepts

Incident response

Communication

Education

Bachelor's degree in Computer Science or related field

Tools

SIEM

Cloud monitoring tools

CI/CD integration

Vulnerability scanning tools

Python scripting

Bash scripting

Job description

The Security Engineer protects digital assets, infrastructure, and applications through vulnerability management, security engineering, and incident response. Reporting to the Staff DevOps Engineer, you will work closely with engineering teams to address risks, strengthen security controls, and prepare technical teams and leadership for security incidents.

Security engineering responsibilities

• Monitor open-source and third-party dependencies using Software Composition Analysis tools to identify and mitigate software supply chain risks.
• Track and prioritize Common Vulnerabilities and Exposures affecting the technology stack.
• Partner with developers to automate dependency updates and integrate security scanning into CI/CD pipelines.
• Manage the scope, execution, and tracking of external penetration tests and bug bounty programs.
• Validate testing findings and turn vulnerabilities into actionable remediation plans.
• Conduct internal vulnerability scans and architectural risk assessments.
• Drive remediation across infrastructure, networks, and applications.
• Provide technical guidance and review code and configurations for secure development practices.
• Implement identity and access policies, network segmentation, secrets management, and other protective controls.
• Monitor cloud configurations to identify configuration drift and security weaknesses.

Incident response and preparedness

• Participate in the incident response team and on-call rotation to detect, contain, and eradicate security incidents.
• Investigate suspicious activity using SIEM, endpoint detection and response, and cloud logs.
• Conduct root‑cause analysis and document lessons learned after incidents.
• Design and lead security tabletop exercises for technical teams and executive leadership.
• Develop realistic ransomware and supply chain attack scenarios to test response plans and identify communication or tooling gaps.
• Define and report security metrics, including remediation time and patch compliance.
• Gather evidence and maintain controls supporting SOC 2, ISO 27001, and HIPAA requirements.
• Mentor junior engineers and create targeted security training materials.

Required qualifications

• Bachelor's degree in Computer Science, Software Engineering, or a related technical field.
• At least 3 years of experience in security engineering, application security, or incident response.
• Hands‑on experience with modern vulnerability, application testing, security monitoring, and observability tools.
• Strong understanding of OWASP Top 10, CWE, and cloud security best practices.
• Experience integrating security scanning and controls into CI/CD pipelines and build automation.
• Proficiency in Python and Bash scripting for security automation and tooling.

Preferred qualifications

• Experience securing containerized and cloud-native environments, including AWS or GCP and native cloud security tools.
• Hands‑on experience with governance, risk, and compliance platforms.
• Familiarity with Infrastructure as Code security scanning.
• Relevant certifications such as CISSP, CEH, OSCP, GCIH, or AWS Certified Security.
• Ability to explain technical security concepts to non‑technical stakeholders.
• Familiarity with bug bounty services.
• Experience with cloud-connected IoT devices, including provisioning, key rotation, and over‑the‑air update security.