Security Engineer

Role overview Build and run the security foundations for a growing software platform in a first dedicated security engineering role. You will work hands-on with leadership and an external compliance partner, combining technical reviews and remediation with the work needed to prepare for certification and respond clearly to customer and auditor questions.

Responsibilities - Lead ISO 27001 preparation, including a gap analysis, risk register, recurring controls, and internal audit. - Review identity, authorization, tenant isolation, and key security assumptions; rank findings and guide remediation. - Scope and coordinate an independent penetration test, then track critical issues through resolution. - Triage security findings and monitor changes in security benchmark alignment. - Maintain an answer library and support customer security questionnaires and selected calls, aiming for responses within five working days. - As the platform develops, contribute to threat modeling and possible work on network controls, customer-managed keys, and further compliance readiness.

Requirements - Strong hands-on security engineering experience, beyond compliance administration. - Practical experience preparing for or working with ISO 27001. - Strong AWS security knowledge, especially IAM and KMS. - Familiarity with OAuth 2.0, OpenID Connect, and reading infrastructure-as-code. - Ability to work independently and take ownership in a small team.

Nice to have - Experience with AI-agent or MCP security, penetration test scoping, SOC 2, or DORA.

Benefits and work setup - Early opportunity to shape security practices across the product and organization. - Direct collaboration with leadership and an external compliance partner in a small team with real customers.