Senior Security Engineer

LoancrateMortgage technology

Location: United States; Workplace: RemoteFull-TimeSenior

Salary170,000 - 300,000 USD per year

Apply NowOpens the employer's application page

Job Details

Bring deep application security experience, including threat modeling, OWASP Top 10, secure code review, and SAST/DAST tooling.
Have strong AWS security experience across services and controls such as IAM, VPC, GuardDuty, Security Hub, CloudTrail, KMS, Secrets Manager, and WAF.
Be proficient with Terraform and/or Pulumi and able to review infrastructure as code for security implications.
Have hands-on SOC 2 experience designing controls, collecting evidence, and managing an auditor relationship.
Have experience integrating security tooling into CI/CD pipelines.
Bring fintech or regulated-industry experience, ideally involving lending or financial services.
Have identity and access experience with SSO/SAML, SCIM, MFA enforcement, hardware security keys, and access reviews.
Be familiar with protecting sensitive personal and financial data, including encryption, data classification, and minimization.
Be able to document decisions, write runbooks, and communicate security risks to non-security audiences.
Have scripting and automation experience in Python, Bash, or similar.

Lead security posture across application security, cloud security, identity, and compliance in partnership with engineering and leadership.
Conduct threat modeling, vulnerability assessments, and penetration testing, and work with engineering to remediate findings.
Build and maintain security automation for SAST/DAST, dependency and container scanning, SBOM management, and secret detection in CI/CD.
Harden AWS infrastructure, including IAM, VPC boundaries, secrets management, audit logging, GuardDuty, Security Hub, KMS, and DDoS protection.
Own the SOC 2 Type II program by designing controls, automating evidence collection, managing auditor relationships, and driving improvement.
Coordinate security incident response, including runbooks, postmortems, and communication with customers and leadership when needed.
Establish a secure SDLC through design reviews, threat modeling, and developer training, documentation, and examples.
Maintain a risk register with identified threats, ownership, and remediation status.
Partner with Operations on endpoint and device security, including laptop hardening, MDM policy, hardware keys, and access revocation.
Manage vendor security risk and identity and access infrastructure, including SSO, MFA, SCIM provisioning, and access reviews.

View Full Description & ApplyYou'll be redirected to the employer's site