Senior Security Engineer

Hirewell; Itasca (IL); On-site; USD 180,000 - 240,000; Full time

Job summary

Hirewell is partnering with a growing technology organization in the financial services sector to identify a Senior Security Lead who will own the cybersecurity program across a modern tech environment.

The ideal candidate will drive security strategy, manage risk, and partner with engineering and leadership to implement secure development practices, threat modeling, and incident response. This role emphasizes hands-on security leadership in a regulated industry.

Qualifications

• 10+ years of progressive cybersecurity experience with leadership.
• Hands-on with application security, DevSecOps, and secure SDLC.
• Experience with SAST, DAST, and SCA tools.
• Knowledge of threat modeling, API security, OWASP Top 10, microservices, and container security.
• Experience with vulnerability management, remediation, and patching.
• Strong understanding of network security, firewalls, segmentation, WAF, and DDoS protection.
• Experience implementing SIEM and secrets management solutions.
• Incident response programs and security policy development.
• Familiarity with SOC 2 audits, NIST CSF, and compliance requirements.
• Ability to work independently and collaborate with technical and non-technical stakeholders.

Responsibilities

• Lead and continuously improve application security practices, including SAST, DAST, and SCA tooling within CI/CD pipelines.
• Partner with engineering teams to implement secure development practices, conduct threat modeling, and identify application and infrastructure risks.
• Own vulnerability management processes, including assessments, remediation tracking, and patch management.
• Oversee security infrastructure, including firewalls, network segmentation, WAF, DDoS protection, SIEM, and secrets management.
• Lead incident response efforts, develop response procedures, and coordinate post-incident reviews.
• Drive security compliance initiatives, including SOC 2 Type I and Type II readiness, policies, procedures, and audit coordination.
• Conduct security assessments and manage relationships with third-party penetration testing providers.
• Establish security policies, access controls, and security awareness practices across the organization.
• Evaluate and implement security tools and technologies to continuously improve the company's security posture.
• Work closely with engineering and leadership teams to identify risks and translate security requirements into practical solutions.

Skills

Application security

DevSecOps

Secure SDLC

Threat modeling

Vulnerability management

Network security

Incident response

SOC 2 / NIST CSF knowledge

Stakeholder collaboration

Security leadership

Education

Bachelor's degree in Computer Science / Information Technology / Cybersecurity

Tools

SonarQube

Guardicore

Cloudflare

HashiCorp Vault

Job description

We're partnering with an established, growing technology organization in the financial services industry to identify a Senior Security Lead. This is an opportunity to take ownership of cybersecurity initiatives across a modern technology environment, working closely with engineering, IT, and business leadership.

The ideal candidate is someone who enjoys being hands‑on while also having the ability to drive security strategy, establish processes, and take ownership of the organization's overall security posture. This person will play a key role in strengthening security practices, managing risk, and helping guide the company's cybersecurity roadmap.

What You'll Be Doing

• Lead and continuously improve application security practices, including SAST, DAST, and SCA tooling within CI/CD pipelines.
• Partner with engineering teams to implement secure development practices, conduct threat modeling, and identify application and infrastructure risks.
• Own vulnerability management processes, including assessments, remediation tracking, and patch management.
• Oversee security infrastructure, including firewalls, network segmentation, WAF, DDoS protection, SIEM, and secrets management.
• Lead incident response efforts, develop response procedures, and coordinate post‑incident reviews.
• Drive security compliance initiatives, including SOC 2 Type I and Type II readiness, policies, procedures, and audit coordination.
• Conduct security assessments and manage relationships with third‑party penetration testing providers.
• Establish security policies, access controls, and security awareness practices across the organization.
• Evaluate and implement security tools and technologies to continuously improve the company's security posture.
• Work closely with engineering and leadership teams to identify risks and translate security requirements into practical solutions.

What We're Looking For

• 10+ years of progressive cybersecurity experience, including technical leadership or ownership of security initiatives.
• Strong hands‑on experience with application security, DevSecOps, and secure software development practices.
• Experience implementing and managing SAST, DAST, and SCA tools.
• Knowledge of threat modeling, API security, OWASP Top 10, microservices, and container security.
• Experience with vulnerability management, remediation, and patching across applications and infrastructure.
• Strong understanding of network security, firewalls, segmentation, WAF, and DDoS protection.
• Experience implementing or managing SIEM and secrets management solutions.
• Experience leading incident response programs and developing security policies and procedures.
• Familiarity with SOC 2 audits, compliance requirements, and NIST Cybersecurity Framework.
• Ability to work independently, manage competing priorities, and collaborate with both technical and non‑technical stakeholders.

Preferred Qualifications

• Experience with tools such as SonarQube, Guardicore, Cloudflare, HashiCorp Vault, or comparable platforms.
• Background in financial services, fintech, trading platforms, or another regulated industry.
• Familiarity with NFA/CFTC requirements or financial services security guidelines.
• CISSP, CISM, CEH, or other relevant security certifications.
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.