Senior Security Engineer

Bisecthosting; United States; On-site; USD 140,000 - 210,000; Full time

Job summary

BisectHosting is seeking a Senior Security Engineer to own security across our infrastructure, applications, and internal operations. You will perform security reviews, threat modeling, and ongoing risk management in a fast-moving environment.

The role emphasizes hands-on work, including code reviews, penetration testing, and implementing practical controls. You will collaborate with engineering and leadership to protect customers and internal systems while maintaining business velocity.

Qualifications

• Extensive background in security engineering across applications and infrastructure.
• Hands-on, self-driven with ability to juggle multiple security initiatives.
• Strong knowledge of OWASP Top 10 and secure coding practices.
• Experience with penetration testing, vulnerability assessments, and security tooling.
• Proven ability to implement IAM, RBAC, MFA and least-privilege access policies.
• Familiarity with CI/CD security controls and secure software supply chains.
• Experience communicating security risks to technical and non-technical audiences.

Responsibilities

• Own and improve security across apps, infra, and internal operations.
• Perform code reviews to identify vulnerabilities and work with engineers on fixes.
• Conduct hands-on pentesting and vulnerability assessments across web apps, APIs, networks, and cloud.
• Secure internal/external APIs with proper auth and credential management.
• Lead IAM including RBAC, MFA, SSO, and access audits.
• Establish security standards for tools, cloud, and production infra.
• Lead security awareness initiatives, including phishing simulations.
• Identify risks in workflows and implement safeguards.

Skills

Security engineering

Application security

Infrastructure security

Penetration testing

IAM

RBAC

MFA

SSO

OWASP

CI/CD security

Threat detection

Vulnerability assessments

Code review

Security tooling

Education

OSCP

CISSP

GIAC

Tools

SAST

DAST

Dependency scanning

Secrets detection

GitHub security workflows

SIEM

Phishing simulations

Incident response

Cloud security

OWASP Top 10

Job description

If in the USA, applicants MUST reside in Arizona, Idaho, Indiana, Ohio, Michigan, New York, Pennsylvania, Texas, or Washington

BisectHosting is hiring a Senior Security Engineer to take ownership of security across our entire business, from infrastructure and application security to employee awareness and internal operations.

We're looking for someone who thrives in a fast-moving, startup-like environment, enjoys wearing multiple hats, and isn't afraid to get their hands dirty. You'll have the freedom and responsibility to identify risks, set priorities, and implement solutions without needing constant direction.

This is a highly hands-on role. One day you might be reviewing code for vulnerabilities, the next conducting penetration tests, securing internal tools, or training employees on social engineering risks. You'll work directly with engineering and leadership to build practical security measures that protect our customers, employees, and infrastructure without unnecessarily slowing down the business.

What you'll work on:

• Own and continuously improve security across applications, infrastructure, internal systems, and business operations
• Conduct security-focused code reviews, identify vulnerabilities, and work directly with engineers to implement fixes
• Perform hands-on penetration testing and vulnerability assessments across web applications, APIs, networks, and infrastructure
• Secure internal and external APIs through proper authentication, authorization, access controls, and credential management
• Own identity and access management (IAM), including employee permissions, role-based access controls, least-privilege policies, and regular access audits
• Establish practical security standards for internal tools, third-party services, cloud environments, and production infrastructure
• Lead employee security awareness initiatives, including phishing simulations, social engineering testing, and security training
• Identify risks in everyday employee workflows and implement technical or procedural safeguards to reduce exposure
• Implement and maintain security monitoring, vulnerability scanning, threat detection, and incident response processes
• Build automated security checks into development workflows, including code scanning, dependency auditing, and CI/CD security controls
• Investigate security incidents, identify root causes, and implement preventative improvements
• Independently identify, prioritize, and execute security initiatives based on business risk and impact
• Work across departments to solve security problems, even when they fall outside traditional engineering responsibilities

Requirements

What we're looking for:

• Strong professional experience in security engineering, application security, infrastructure security, or a similar role
• A self-starter who can manage their own time, establish priorities, and drive projects from identification through implementation
• Comfortable wearing multiple hats and taking responsibility for problems outside a narrowly defined job description
• Hands-on mentality with a willingness to investigate problems, write code, configure systems, and implement fixes personally
• Strong understanding of application security, secure coding practices, and common vulnerabilities such as those outlined by OWASP
• Experience with penetration testing, vulnerability assessments, and security testing tools
• Strong understanding of API security, authentication, authorization, OAuth, access tokens, and credential management
• Experience managing IAM, RBAC, MFA, SSO, and least-privilege access policies
• Strong Linux, networking, Docker, and cloud infrastructure security fundamentals
• Experience securing production applications, databases, internal tools, and cloud environments
• Familiarity with automated security tooling, including SAST, DAST, dependency scanning, and secrets detection
• Ability to evaluate human security risks, including phishing, social engineering, and unsafe employee practices
• Strong problem-solving skills and the ability to make practical security decisions with limited resources or incomplete information
• Ability to communicate security risks clearly to technical and non-technical employees
• Comfortable operating independently in a fast-paced environment with changing priorities and minimal bureaucracy
• Practical approach to security that balances risk reduction, usability, and business needs

Preferred Qualifications:

• Experience as an early security hire or owning security at a startup or growing technology company
• Experience securing hosting platforms, SaaS products, or large-scale infrastructure environments
• Experience with Cloudflare, AWS, and bare-metal infrastructure security
• Experience securing PHP/Laravel applications, REST APIs, and MySQL databases
• Familiarity with GitHub security workflows, automated pull request scanning, and software supply-chain security
• Experience conducting internal red-team exercises, phishing campaigns, and social engineering simulations
• Experience with SIEM platforms, intrusion detection, centralized logging, and threat intelligence
• Experience with endpoint security, device management, and employee onboarding/offboarding security processes
• Experience building security processes and tooling from the ground up
• Relevant security certifications such as OSCP, CISSP, GIAC, or equivalent demonstrated experience

Salary Description