Security Engineer II; Cloud Security

Overview

As a member of the Ship Bob Team, you will …

• Grow with an Ownership Mindset
  :
  
  We champion continuous learning and innovation.
  
  You'lltake on real problems,create tangible solutions, anddrive results that move the needlefor
  
  ShipBob,our merchants, and for your own professional growth.
  
  Ifyou'reready to do the most meaningful work of your career, this is the place.
• Collaborate with Peers and Leaders Alike
  :
  
  At Ship Bob ,leaders are accessible;feedback flows in both directions, and everyone, regardless of their seniority or role, steps up to help when needed.
  
  We hold each other tohigh standards because we trust each other to meet them. That combination of transparency and mutual respect is what makes the work here feel worth doing.
• Experience a High-Performance Culture and Clear Purpose
  :
  
  We are results-driven andclear about what that means: ourgoals are specific, accountability is shared, and every team member can see how their work connects toour mission. When we hit milestones, we celebrate them together. When we fall short, we learn and move forward.

Remote - India

US Hours 7 pm-4 am IST

As a Security Engineer II, you will play a pivotal role in Ship Bob’s Information Security and Governance, Risk, and Compliance programs. You will design, implement, and maintain access control and threat detection solutions, participate in risk assessments and audits, and collaborate across teams to ensure the confidentiality, integrity, and availability of our critical data and systems. You will also support monitoring and detection, vulnerability assessments and incident response for Ship Bob.

This role reports to the Vice President, Information Tech & Security.

• Monitor security alerts, investigate incidents, and escalatat needed across security tools.
• Support SIEM and detection (Sentinel, Defender XDR), tuning alerts and improve detections.
• Assist vulnerability management program by working with IT/Engineering and other app developers by providing security expertise, tracking remediation and ensuring SLA compliance.
• Help manage identity security including conditional access, PIM, MFA, RBAC, risky sign‑ins, and access reviews.
• Maintain security documentation and collect evidence.
• Develop and automate security workflows, playbooks, and tools to improve the efficiency and effectiveness of security operations.
• Develop, enforce, and update security policies, procedures, and guidelines for access control, threat detection, and compliance with standards such as ISO 27001, SOC 2, PCI, NIST CSF, and Sarbanes-Oxley.
• Communicate risks and vulnerabilities to stakeholders, document remediation plans, and proactively share information with management.
• Build and execute regular threat hunting campaigns focused on current, emerging, and obscure tactics, techniques, and procedures.
• Proactively search for, identify, and analyze new and existing techniques to detect advanced and targeted threats.
• Utilize advanced threat hunting techniques to detect anomalies and suspicious activities.
• Collaborate with security team members, developers, operations, and stakeholders to share knowledge and best practices.
• Identify process improvements and provide actionable guidance.
• Perform other duties as assigned.

• 4+ years of hands‑on work experience with security architecture and engineering in a cybersecurity operations program.
• 2+ years of experience in incident response, detection, threat intelligence, or access control security engineering roles.
• Excellent knowledge and experience with access control frameworks and tools (IAM, RBAC, ABAC, OAuth, SAML), cloud security, network security, endpoint security, and threat intelligence.
• In‑depth knowledge of Azure services (especially Azure Active Directory, Azure AD Identity Protection, Azure RBAC), and experience securing cloud‑based infrastructures (Azure, M365, Google Workspace, Salesforce).
• Proficiency in scripting languages such as Python, Power Shell, Go, or Bash.
• Strong knowledge of industry‑standard frameworks (MITRE ATT&CK, ISO 27001, SOC 2, NIST CSF, PCI, SOX, GDPR).
• Proven ability to manage multiple risk and compliance projects.
• Stro…