Note: The job is a remote job and is open to candidates in USA. RemoFirst is transforming the way businesses hire and manage global teams by providing an all-in-one global HR platform. They are seeking a Lead Security Engineer to oversee identity and access management, conduct security engineering and pentesting, and manage governance, risk, and compliance efforts within the organization.
Responsibilities
- Own the architecture and security of our Auth0 implementation for client-facing applications
- Manage and automate our Okta environment, ensuring seamless SSO, lifecycle management (onboarding/offboarding), and hardware-based MFA
- Enforce 'Least Privilege' across our AWS ecosystem, managing complex AWS IAM policies and Service Control Policies (SCPs)
- Conduct regular internal pentests and vulnerability scans against our Python/Django and Java/Spring Boot services as well as coordinate with 3LOD pen testers
- Work alongside devs to review code, secure our Postgres databases, help engineers with thread modelling and harden our Kafka message streams
- Define the guardrails for our AI initiatives, ensuring data privacy in LLM prompts and securing our model pipeline
- Take the wheel for our SOC 2 Type II and ISO 27001 certifications
- Maintain our internal risk register as well as helping our Front-line teams with inbound security questionnaires from large clients
- Utilize compliance automation tools to ensure we stay 'audit-ready' every single day, not just once a year
- Help draft and implement pragmatic security policies that reflect how a modern startup actually works
Skills
- 5+ years of experience in security engineering
- Familiarity with core tech stack: Python/Java with Django, FastAPI & SpringBoot
- Experience with Kafka & RabbitMQ for interservice communications
- Experience with PostgreSQL and some MongoDB on persistence layer
- Strong knowledge of Cloud Infrastructure: AWS with EKS, RDS, IAM, S3
- Comfortable with IAM - experience with Okta and/or Auth0
- Good understanding of protocols like SAML, OIDC, and API-based security
- Familiarity with SOC2 and ISO27001 audit cycle
- Comfortable working with Risk & Compliance teams, both internal and external
- Ability to explain complex ISO 27001 requirements to software engineers
- Ability to find ways to enable the business to move fast, safely
- An AI Enthusiast: Keeping up with the OWASP Top 10 for LLMs and understanding the risks of prompt injection and data leakage
Company Overview