Senior Security and Compliance Engineer

KEH Camera; Atlanta (GA); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

401(k) plan

Health and dental coverage

Paid time off

Job summary

KEH seeks a Senior Security Engineer to own KEH's security program across e‑commerce, retail, and corporate operations. You will protect payment data, PII, and employee data, driving security governance, cloud/app security, and incident response in an fast-paced environment.

You will collaborate with IT, Engineering, Legal, Finance, and HR to embed security into systems, ensure PCI DSS and privacy compliance, and lead proactive risk management and awareness efforts across a distributed

Qualifications

• Bachelor's degree in computer science, information security, or related field, or equivalent experience.
• 10+ years in information security, cybersecurity, risk, or compliance, incl. e‑commerce and payment data.
• Demonstrated ownership of incident response (IR program).
• Strong security principles, controls, vulnerability management, data protection.
• Hands-on cloud security experience (GCP) with app infra and 3rd‑party integrations.
• Experience implementing PCI DSS compliance program.
• Experience securing a distributed/remote workforce (endpoints, remote access).
• Knowledge of privacy rules (CCPA, GDPR) in employee data context.

Responsibilities

• Develop, implement, and enforce security policies, controls, and procedures protecting data.
• Conduct risk assessments, vulnerability reviews, and security audits; document findings and drive mitigations.
• Design and maintain security controls across cloud, e‑commerce, and network environments; include access controls and segmentation.
• Own incident response end-to-end: IR plan, investigations, containment, and lessons learned.
• Ensure PCI DSS and privacy compliance, including documentation and evidence.
• Build and maintain compliance documentation, risk registers, and audit-ready records.
• Collaborate with IT, Engineering, Legal, Finance, Operations, and HR to embed security in systems and processes.
• Monitor threats and regulatory changes; implement proportionate safeguards.
• Advise on security best practices, data handling, and incident escalation.
• Develop and deliver security awareness training and communications.

Skills

Incident response ownership

Cloud security (GCP)

PCI DSS compliance

Privacy & data protection

Security governance & controls

Risk management

Education

Bachelor's degree or equivalent

Tools

SIEM tooling

Vulnerability scanning

Penetration testing

IAM

Job description

IT, Engineering, Legal, Finance, Operations, and Human Resources

Direct Reports

None

Date

September 2026

Classification

Exempt, Full-Time

ABOUT KEH

KEH is the world’s largest reseller of pre-owned camera gear and a trusted name for photographers, videographers, and creators. Founded in 1979, the company maintains an inventory of more than 55,000 items, serves a loyal community of professional and enthusiast photographers, and has built its reputation on an industry-standard equipment grading system, a 180-day warranty, and a customer experience consistently ranked among the best in online retail.

The re-commerce market is in the early stages of a significant growth cycle as consumers increasingly seek to buy, sell, and trade pre-owned products. KEH is investing aggressively to capture this opportunity — expanding its product categories, growing adjacent business lines, and building the technology and operational infrastructure to support the next stage of scale. KEH is majority owned by D Cubed Group, a private equity firm.

THE ROLE

The Senior Security Engineer protects the systems, networks, and data that support KEH's e-commerce, retail, and corporate operations. This is a senior level, high-ownership individual contributor role — you'll be the primary technical owner of KEH's security program, responsible for reducing security risk, protecting payment card information, personally identifiable information, and employee data, and maintaining compliance with the standards and laws that govern our business.

You'll operate across security governance, cloud and application security, network security, regulatory compliance, incident response, and awareness — translating technical and regulatory requirements into practical controls, working closely with teams across the company, and driving issues through remediation in a fast-moving, primarily e-commerce operating environment.

WHAT YOU WILL OWN

• Security governance and controls across KEH's e-commerce, retail, and corporate technology environments, with clear policies, standards, and evidence of effective operation.
• PCI DSS and data privacy compliance programs, including readiness, documentation, testing, remediation, and ongoing monitoring.
• Cloud and application security for our e-commerce platform and supporting infrastructure (GCP), including secure configuration, access controls, and third-party/API integration risk.
• Network and infrastructure security across our facility, retail storefront, and distributed workforce — including segmentation, wireless access, endpoint protection, and secure remote access.
• Security incident response, as the primary owner from detection through containment, remediation, reporting, and lessons learned.
• Security awareness and cross-functional adoption of secure practices throughout the company.

WHAT YOU WILL DO

• Develop, implement, and enforce security policies, procedures, standards, and controls that protect payment card information, personally identifiable information, and employee data.
• Conduct recurring risk assessments, vulnerability reviews, and security audits; document findings, prioritize risk, and drive mitigating controls through completion.
• Design, implement, and maintain security controls across our cloud infrastructure, e-commerce platform, corporate network, retail location, and remote/distributed workforce (including our team based in Eastern Europe) — covering segmentation, firewalls, wireless access, secure configurations, monitoring, and access restrictions.
• Own incident response end-to-end: build and maintain the IR plan and runbooks, lead investigation and containment during active incidents, run periodic tabletop exercises, and drive root‑cause analysis and reporting.
• Manage KEH's compliance with PCI DSS and applicable privacy and data protection requirements — including CCPA, and GDPR as it applies to employee data for our Eastern Europe‑based staff.
• Build and maintain compliance documentation, control evidence, risk registers, remediation plans, and audit‑ready records.
• Partner with IT, Engineering, Legal, Finance, Operations, and Human Resources to integrate security and compliance requirements into systems, projects, vendor relationships, and business processes.
• Monitor emerging threats, vulnerabilities, and regulatory changes; assess their relevance to KEH and implement proportionate safeguards.
• Advise employees and leaders on security best practices, compliance requirements, data handling, and incident escalation procedures.
• Develop and deliver security awareness training and targeted communications that improve employee understanding and behavior.

WHAT WE ARE LOOKING FOR

Required

• Bachelor's degree in computer science, information security, or a related field, or equivalent relevant work experience.
• At least 10 years of experience in information security, cybersecurity, risk, or compliance roles, including meaningful experience supporting e-commerce environments and payment card data.
• Demonstrated ownership of incident response — building or running an IR program, not just participating in one.
• Strong command of security principles, control design, vulnerability management, and data protection mechanisms.
• Hands‑on cloud security experience (GCP preferred), including securing application infrastructure and third‑party integrations.
• Demonstrated experience implementing, operating, or maintaining a PCI DSS compliance program.
• Experience securing a distributed/remote workforce, including endpoint security and secure remote access.
• Working knowledge of CCPA, GDPR (employee‑data context), and other applicable privacy and data protection requirements.
• Strong analytical, problem‑solving, project management, and documentation skills, with the ability to manage multiple priorities independently and with minimal oversight.
• Clear communication and strong interpersonal skills, including the ability to explain security risks and requirements to non‑technical stakeholders and leadership.

Preferred

• CISSP, CISM, CISA, or a comparable security, risk, or audit certification.
• Experience in a high‑volume retail, marketplace, payments, or consumer e‑commerce environment.
• Experience supporting third‑party audits, penetration tests, vulnerability scanning, and remediation programs.
• Familiarity with identity and access management, endpoint protection platforms, and security monitoring/SIEM tooling.
• Experience working with or managing international/distributed teams.

WHO YOU ARE

You are a practical, detail‑oriented security professional who can move comfortably between policy, technical controls, evidence, and execution — and who's ready to be the senior voice on security in the room without a large team behind you. You apply sound judgment, communicate directly, and persist until risks are understood and resolved. You use automation and AI thoughtfully to improve monitoring, analysis, and documentation while maintaining appropriate security and privacy controls.

KEY PERFORMANCE INDICATORS

• PCI DSS compliance is maintained, with required assessments, evidence, and remediation completed on schedule.
• High‑risk audit, vulnerability, and assessment findings are remediated within established target dates, with overdue items clearly escalated.
• Security incidents are detected, contained, investigated, and documented within defined response expectations, with corrective actions tracked to completion.
• Security policies, risk assessments, control evidence, and incident response documentation remain current and audit‑ready.
• Required security awareness training is completed on time, and employee security testing and reporting trends improve over time.

COMPENSATION AND BENEFITS

KEH offers a competitive compensation package commensurate with the scope and seniority of this role. The total compensation framework includes base salary and eligibility for a performance-based annual incentive. Benefits include a 401(k) plan, comprehensive health and dental coverage, short‑term disability, paid time off, paid holidays, and flexible spending accounts.

WHY KEH

KEH offers the opportunity to build and mature security and compliance capabilities at the world's largest reseller of pre‑owned camera gear. This role has direct influence over how the company protects its customers, employees, systems, and reputation as KEH scales its e‑commerce and operating platform.

LOCATION AND TRAVEL

This role is based in Atlanta, Georgia (Smyrna) and is expected to be on‑site on a full‑time basis. Occasional travel may be required for assessments, training, vendor meetings, or site support.

KEH is an equal opportunity employer committed to a diverse and inclusive workplace.