Senior Security Engineer

topcon; United States; Hybrid; USD 140,000 - 190,000; Full time

Job summary

Topcon Positioning Group seeks a Senior Security Engineer specializing in Application Security to drive threat modeling, secure design reviews, and secure code reviews for web, API, and cloud services. The role also manages offshore security vendor relationships, coordinates across time zones, and strengthens security operations and incident response.

Ideal candidates have 6+ years in security engineering, exposure to AI/ML security concepts, and relevant certifications.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or related field, or equivalent experience.

Responsibilities

• Lead application security reviews across the SDLC: threat modeling, secure design review, and secure code review for web, API, and cloud services.
• Serve as primary day-to-day technical contact for offshore security vendor: scoping work, reviewing deliverables, coordinating across time zones, unblocking team, tracking commitments and risks.
• Support detection, monitoring, alert investigation, and incident response within Security Operations.
• Help assess and secure AI/ML and LLM-based systems, contribute to AI security standards, review processes, and guardrails.

Skills

Application Security

Threat Modeling

Secure Code Review

Vulnerability Remediation

Offshore Vendor Mgmt

AI Security

Cloud Security

Python Scripting

Security Operations

Communication

Education

Bachelor's degree in CS/Info Security

Certifications: OSCP/CISSP/CSSLP/GWAPT preferred

Tools

AWS/Azure

CI/CD

Containerization

Job description

Topcon Positioning Group is headquartered in Livermore, California, USA (topconpositioning.com).

We design, manufacture and distribute productivity tools for developing a brighter future. Whether cultivating the earth or building upon it, Topcon brings innovation in workflow automation and seamless connectivity of data to construction, geopositioning and agriculture industries focused on developing a sustainable tomorrow.

Topcon is an equal opportunity employer and does not discriminate against any employee or applicant on the basis of race, color, religion, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, genetic information, or other legally protected status.

To learn more about Topcon career opportunities go to www.topconcareers.com .

Job Purpose:

Serve as a senior individual contributor on the Security Engineering team with a primary focus on Application Security, while contributing to Security Operations and AI Security. Maintain the day-to-day technical relationship with the offshore security vendor - setting expectations, reviewing deliverables, and ensuring quality - and reduce application and operational security risk across the SDLC while helping mature the organization's security practices.

Application Security (primary):

Lead application security reviews across the SDLC - threat modeling, secure design review, and secure code review for web, API, and cloud services.

Offshore Vendor Relationship:

Serve as the primary day-to-day technical contact for the offshore security vendor - scoping work, reviewing deliverables for quality, coordinating across time zones, unblocking the team, and tracking commitments and risks.

Security Operations (SecOps):

Support detection, monitoring, alert investigation, and incident response. Help tune detections, reduce false positives, improve runbooks, and contribute to vulnerability management and infrastructure/endpoint hardening.

AI Security:

Help assess and secure AI/ML and LLM-based systems (prompt injection, data leakage, model abuse, supply-chain risk) and contribute to emerging AI security standards, review processes, and guardrails.

Education and Experience:

• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• 6+ years in security engineering with demonstrated hands-on application security experience (secure code review, threat modeling, vulnerability remediation).
• Practical experience with Security Operations - monitoring, detection, and/or incident response.
• Proven experience maintaining an offshore or third-party vendor relationship across time zones.
• Exposure to AI/ML or LLM security concepts, or a strong demonstrated drive to ramp up quickly.
• Relevant certifications (e.g., OSCP, GWAPT, CSSLP, CISSP, or cloud security) preferred.

Knowledge, Skills, and Attributes:

• Good application security fundamentals (OWASP, secure SDLC, common vulnerability classes).
• Familiarity with cloud security (AWS/Azure), CI/CD, and containerized environments.
• Scripting/automation skills (e.g., Python) a plus.
• Coachable and eager to learn, with a growth mindset and openness to feedback.
• Strong written and verbal communication; effective across engineering, operations, and external partners.
• Self-directed and collaborative, able to manage priorities with little day-to-day instruction.

Physical Requirements:

Standard office/remote work environment. Prolonged periods working at a computer. Occasional travel may be required.

Working Conditions:

Hybrid work arrangement during standard business hours, with periodic coordination across time zones to support the offshore vendor and occasional after-hours work during security incidents.