Cybersecurity Engineer

Role overview Lead application and platform security for a web product with payment flows, authentication, and sensitive business data. The work spans design reviews, security controls, monitoring, and incident response, with a focus on preventing vulnerabilities as the product changes.

Responsibilities - Threat-model new features and review application changes for authorization flaws, injection risks, SSRF, and secret exposure. - Strengthen authentication and authorization, including token and API key handling and rate limits. - Improve cloud and platform protections through least-privilege access, secret management, and dependency and container scanning. - Develop monitoring and alerts to detect suspicious activity and abuse. - Lead incident response and document repeatable procedures in runbooks. - Maintain security reviews for sensitive payment and email-sending paths.

Requirements - At least four years in application security, product security, or security engineering. - Strong web application security knowledge, including OWASP risks and authentication systems. - Experience securing cloud environments such as GCP or AWS. - Ability to read and write code; TypeScript or Node.js experience is useful. - Methodical incident handling and clear written communication.

Benefits and work setup - Remote role within the United States, with a home-office stipend and hubs in Massachusetts and New Hampshire. - Medical, dental, and vision coverage, plus a wellness stipend. - Annual budget for learning, including conferences, courses, and books, and access to mentorship. - Flexible paid time off, including a required minimum.