Senior Security Engineer

We are seeking a Senior Security Engineer, GRC — a hands‑on security engineer who also owns our governance, risk, and compliance programs for a regulated, SaaS based platform. This is a build‑and‑operate role, not a policy‑only one. You will configure and tune the protections that sit in front of our platform, independently evaluate and validate the security tooling we depend on, and automate the evidence and control monitoring behind our compliance programs.

You will also own our SOC 2 audit cycle and our expansion into additional public sector authorization frameworks, our AI governance program, our security monitoring strategy and managed detection partnership, and our third‑party risk process. The through‑line is technical credibility: we want someone who proves a control works by testing the configuration, not only by documenting it, and who can work across engineering, legal, and product to make the result practical and durable.

• Configure, tune, and validate our edge and application‑layer protections — bot management, WAF rule sets, rate limiting, and DDoS/CDN policy — across our CDN and API gateway layers (e.g., Cloudflare, Azure Front Door, Azure API Management)
• Treat the security rule set as a living configuration: baseline it, tune it against real traffic, measure false positives against blocked‑attack coverage, and evolve it as the platform changes
• Review and harden identity and access controls across the platform — role design, privileged access, conditional access, and service principal and workload identity hygiene

• Independently evaluate, configure, and validate our security stack: SIEM and telemetry pipelines, vulnerability scanning including AI‑enabled tooling, and cloud security posture management (CSPM) in Azure
• Judge whether each tool is actually configured to catch what it is supposed to catch — identify coverage gaps, tune signal‑to‑noise, and prove detections fire by testing them
• Own the security monitoring strategy in partnership with infrastructure, including telemetry coverage and detection use cases
• Manage the working relationship with our managed detection provider and hold that partnership to measurable outcomes
• Refine alert triage and escalation paths
• Maintain incident response runbooks and support incident response activities
• Validate NIST 800‑53 control implementations technically, using the tooling we already own, so that control assertions are evidence‑backed rather than asserted

• Own the SOC 2 audit cycle end to end, including scoping, control mapping, evidence collection, auditor coordination, and remediation tracking
• Own our compliance automation platform — configure integrations, automate evidence collection and continuous control monitoring, and eliminate manual evidence gathering
• Keep compliance programs continuously audit‑ready and reduce the manual effort required to sustain them
• Lead expansion into additional security compliance and authorization frameworks as our public sector footprint grows
• Run readiness assessments, drive remediation, and produce system security documentation
• Manage third‑party assessors and sustain continuous monitoring obligations

• Own and mature our security control set aligned to NIST 800‑53 and applicable NIST guidelines
• Partner with infrastructure and engineering so controls are practical to operate, accurately documented, and validated to work as described — validated by testing the configuration, not by attestation alone
• Maintain framework crosswalks so control work and evidence are reused across programs
• Develop and maintain security policies, standards, and procedures
• Own the…