Sr. Security Engineer

Suralink Inc; Salt Lake City (UT); Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Remote-friendly policy

Medical/vision/dental insurance

Flexible PTO

Ten paid holidays

Parental leave

Professional development allowance

Community involvement

Job summary

Suralink is seeking a Senior Security Engineer to own the security posture across cloud, identities, and applications. You will bridge risk management with hands-on engineering, ensuring infrastructure, data, and services stay secure in a remote-first environment.

Lead security roadmap, drive incident response, and manage security tooling with a strong emphasis on audits (SOC 2 Type II) and compliance. Bring autonomous, proactive security leadership to a fast-growing SaaS company.

Qualifications

• 4+ years in dedicated cybersecurity roles, ideally with experience as a 'Security Team of One' or at a scaling startup (50–500 employees).
• Cloud Infrastructure: Hands-on experience with at least one major cloud provider (AWS, GCP, Azure).
• Security Tooling: Experience with modern stack tools (e.g., Wiz, Datadog, Elastic, SentinelOne).
• Code/Scripting: Ability to write scripts (Python, Bash, Go, Javascript, or similar) to automate security tasks and integrate APIs.
• Compliance: Direct experience leading or heavily contributing to a SOC 2 audit.
• Autonomy: Comfort working in a fast-paced environment with minimal supervision.

Responsibilities

• Define the roadmap: Build and maintain our annual security strategy, compliance goals, and risk management frameworks.
• Vendor & tool management: Evaluate, select, and budget for security tooling without over-engineering our stack.
• Compliance & audits: Own or prepare the company for relevant compliance frameworks (e.g., SOC 2 Type II, or GDPR).
• Incident response planning: Create, test, and maintain our Incident Response (IR) and Disaster Recovery (DR) playbooks.
• Cloud & infrastructure security: Harden our cloud environments (AWS/GCP), manage IAM policies, and configure network security.
• AppSec & CI/CD: Integrate automated security scanning (SAST/DAST) into our deployment pipelines and conduct code reviews.
• Endpoint & corporate security: Deploy and manage our MDM, MDR solutions, and identity providers.
• Monitoring & triage: Utilize,Set up log aggregation and investigate security alerts and anomalies.
• Vulnerability and patch management programs, including risk-based prioritization.

Skills

Security governance

Cloud security

Incident response

Vulnerability management

Scripting

SOC 2

IAM

Education

AWS Security Specialty

CISSP

OSCP

GIAC GCIH

Tools

Wiz

Datadog

Elastic

SentinelOne

Terraform

Kubernetes

Jamf

Kandji

Intune

Job description

Suralink® is the agentic automation platform for accounting professionals and their clients, leading the global charge in AI-driven accounting technology. As the leading AI platform for accounting firms, Suralink serves more than 50% of the top 100 enterprise accounting firms in the United States and has over 800,000 users globally.

Our mission is to empower the people we serve to redefine the meaning of efficiency in the accounting technology industry. Our award-winning SaaS platform was built for CPA firms, providing a simple, secure way to manage audit, tax, and advisory engagements.

Recognized for growth, innovation, and culture, we foster a highly collaborative, remote-first environment where exceptional, motivated professionals can make a meaningful impact. If you're passionate about building relationships and driving growth at a fast-growing SaaS company, we'd love to talk with you

Who we are looking for:

As our Senior Security Engineer, you will own our entire security posture. We are a growing company and we need someone who can plan our security roadmap and execute the technical work to back it up. You will bridge the gap between high-level risk management and hands-on engineering, ensuring our infrastructure, applications, and corporate data remain secure.

Key Responsibilities:

• Define the roadmap: Build and maintain our annual security strategy, compliance goals, and risk management frameworks.
• Vendor & tool management: Evaluate, select, and budget for security tooling without over-engineering our stack.
• Compliance & audits: Own or prepare the company for relevant compliance frameworks (e.g., SOC 2 Type II, or GDPR).
• Incident response planning: Create, test, and maintain our Incident Response (IR) and Disaster Recovery (DR) playbooks.

Hands-on Execution & Engineering

• Cloud & infrastructure security: Harden our cloud environments (AWS/GCP), manage IAM policies, and configure network security.
• AppSec & CI/CD: Integrate automated security scanning (SAST/DAST) into our deployment pipelines and conduct code reviews.
• Endpoint & corporate security: Deploy and manage our MDM, MDR solutions, and identity providers.
• Monitoring & triage: Utilize,Set up log aggregation and investigate security alerts and anomalies.
• Vulnerability and patch management programs, including risk-based prioritization

Culture & Enablement

• Security awareness: Run phishing simulations and train a remote workforce on security best practices.
• Trust & sales enablement: Unblock sales by answering security questionnaires and ensure that we follow up what we promised our customers.

Experience and Professional Qualifications:

• 4+ years in dedicated cybersecurity roles, ideally with experience as a "Security Team of One" or at a scaling startup (50–500 employees).
• Cloud Infrastructure: Hands-on experience with at least one major cloud provider (AWS, GCP, Azure)
• Security Tooling: Experience with modern stack tools (e.g., Wiz, Datadog, Elastic, SentinelOne).
• Code/Scripting: Ability to write scripts (Python, Bash, Go, Javascript, or similar) to automate security tasks and integrate APIs.
• Compliance: Direct experience leading or heavily contributing to a SOC 2 audit.
• Autonomy: Comfort working in a fast-paced environment with minimal supervision.

Additional Preferred Qualifications:

• Experience with GRC automation platforms (Vanta, Drata) and with additional frameworks such as ISO 27001, HIPAA, PCI DSS, or GDPR
• Infrastructure-as-code and container security (Terraform, Kubernetes, Docker), including policy-as-code and guardrails
• Endpoint and device management (Jamf, Kandji, Intune) and corporate IT security fundamentals
• Relevant certifications (AWS Security Specialty, CISSP, OSCP, GCIH, or similar). Familiarity with securing AI/LLM-enabled products and internal AI tool usage

Competencies:

• Can explain risk to executives and engineering teams alike
• Ability to recognize existing gaps and make remediation recommendations
• Pragmatic Mindset: Ability to balance strict security practices with business agility and developer velocity.
• Proven track record of building security programs from scratch, not just maintaining existing ones.

At Suralink, our values guide everything we do:

• Customer Obsessed: We seek to understand those we serve deeply and are committed to serving them better than anyone else.
• Passionately Motivated: We care about what we do, which drives us to work hard, show grit, and go above and beyond to achieve great outcomes.
• Constantly Improving: We are eager to learn and grow. Challenges are opportunities to innovate and enhance our solutions.
• Team Focused: We know that our success is built together. We support one another and celebrate team achievements.
• Highly Reliable: We demonstrate good judgment, honor our commitments, and are accountable for our results.

Why Suralink?

There’s a lot to love about working at Suralink! Here are a few of the benefits you can expect:

• Remote-friendly policy
• Medical/vision/dental insurance
• Flexible PTO policy and ten paid holidays
• Parental leave
• Professional development allowance
• Community involvement