Security Assurance Engineer

Job Summary

We are seeking a hands-on Security Assurance Engineer to help evaluate, validate, and improve security controls across applications, cloud infrastructure, and enterprise technology services. The engineer will partner with engineering and security stakeholders to identify gaps, document risk, drive remediation, and produce clear evidence that controls operate as intended. This is an assurance and technical security role, not a dedicated identity and access management (IAM) position.

Duties and Responsibilities

• Perform risk-based security assessments of applications, APIs, cloud services, infrastructure, and engineering workflows.
• Validate implementation and operating effectiveness of security controls through technical reviews, evidence collection, and repeatable testing.
• Review architecture and design changes; identify threats, control gaps, and practical mitigations before deployment.
• Partner with developers, SRE/platform teams, and product owners to triage findings, prioritize risk, track remediation, and verify closure.
• Evaluate vulnerability management practices, secure configuration, logging, monitoring, secrets handling, and data protection controls.
• Support secure software development lifecycle (SSDLC) assurance, including threat modeling and security test results review.
• Communicate findings in clear written assessments, actionable tickets, risk summaries, and stakeholder-ready reporting.

Requirements and Qualifications

• Professional experience in security assurance, product/application security, cloud security, security engineering, or technical risk assessment.
• Ability to evaluate security design and controls for modern distributed services, APIs, Linux environments, and cloud-native systems.
• Hands-on knowledge of vulnerability classes, remediation validation, secure configurations, logging, and defense-in-depth principles.
• Working understanding of threat modeling and established security guidance such as OWASP, NIST CSF / SP 800-53, or CIS Benchmarks.
• Ability to turn ambiguous security risks into well-scoped engineering recommendations and verify technical remediation.
• Strong collaboration, technical writing, and communication across security, engineering, and program stakeholders.
• Familiarity with public cloud security (AWS, Azure, or Google Cloud Platform), containers, Kubernetes, and infrastructure as code.
• Experience interpreting SAST, DAST, dependency-scanning, container-scanning, or cloud posture findings.
• Python or another scripting language for evidence automation, control checks, or data analysis.
• Experience supporting audit/readiness work by mapping technical evidence to security control requirements.
• Relevant professional certifications (for example, CISSP, CCSP, GIAC, or cloud security certifications); not required.