Note: The job is a remote job and is open to candidates in USA. Software Guidance & Assistance, Inc. (SGA) is a technology and resource solutions provider offering IT consulting and staffing services. The Information Security Engineer will define, deliver, operate, and continuously improve enterprise security tools, with a focus on an LLM-based code vulnerability detection and reporting capability. The role includes building AWS-based scanning infrastructure, evaluation harnesses, CI/CD pipelines, operational telemetry, and ongoing production support.
Responsibilities
- Serve as a security engineer/consultant on cloud projects
- Build and operate an LLM-based code vulnerability detection capability on AWS Bedrock, including prompt/agent design, model invocation patterns, cost and token controls, and result normalization
- Develop and maintain the evaluation harness used to measure scanner quality, including regression corpora, repeatable test execution, and reporting on detection performance over time
- Build and maintain scanning pipelines integrated with GitHub and Jenkins, deployed to ECS and provisioned through Terraform
- Deliver findings and operational telemetry into Splunk; build dashboards and alerting for scanner health, coverage, and throughput
- Engineer and implement well-architected solutions while adhering to software development best practices
- Advise Principal Engineers and Product Owners on operations and evolution of their product
- Design, test, and implement solutions at the Feature level
- Support the Bank's operational information security responsibilities, including the development and maintenance of standards, procedures, and guidelines necessary to satisfy the Information Security department's operations
- Provide ongoing operational support, patching, and defect resolution for the deployed scanner after go-live
- Participate in a four-person rotating shift schedule providing 24/7 coverage, including nights, weekends, and holidays. Scheduled hours average 40 per week
- Maintain appropriate controls and documentation to ensure compliance with all company and regulatory requirements
- Understand virtualization/containerization technologies
- Participate in operational on-call rotation within normal working hours (not eligible for overtime)
Skills
- 4+ years of related engineering experience, including hands-on information security or software development work
- Hands-on experience with AWS Bedrock or equivalent hosted LLM platforms, including model selection, inference optimization, and guardrail configuration
- Demonstrated understanding of Infrastructure as Code best practices and strong experience building Terraform modules
- Experience building and maintaining CI/CD pipelines, preferably Jenkins, integrated with GitHub
- Working knowledge of application security concepts, common vulnerability classes, and SAST/SCA tooling behavior
- Must be able to communicate ideas both verbally and in writing to management, business and IT sponsors, and technical resources in language appropriate for each group
- Eligible to work in the US without the need for sponsorship now or in the future
- Demonstrated experience building on AWS, including IAM, ECS, and service-to-service authentication patterns
- Experience with agentic or multi-step LLM workflows, including context management across large repositories
- Experience with RESTful APIs and event-driven architectures
- Splunk development experience, including data onboarding, search, and dashboarding
- Experience with containerized workloads and Linux systems
- Experience working in Agile methodologies and development
- Prior experience in a regulated financial services environment
- Industry standard certifications such as AWS Security Specialty, AWS Solutions Architect Associate, CompTIA Security+, ISC2 CISSP, or SANS
Benefits
- Remote work arrangement
Company Overview