Senior Information Security Engineer

About this position

Founded in 2014, we offer the industry's first and only cloud-based, fully-customizable, end-to-end software solution to automate securities-based lending from origination through the life of the loan. By combining thought leadership in suitability and risk management with industry-leading education and the latest technology, Supernova enables advisors to deliver holistic, goals-based advice and to help their clients achieve financial wellness. We partner with the industry's largest banks, most prominent insurance companies and leading online brokerages to democratize access to securities-based lending and better the entire financial ecosystem.

At Supernova Technology, we believe that the best results come from a team that is passionate, driven, and supported in all aspects of their professional lives. Here, you'll work alongside talented and innovative individuals who are committed to driving the future of securities-based lending technology. We foster a culture of collaboration, continuous learning, and growth, where each person's contributions make a real impact.

We are seeking a highly skilled and hands-on Senior Security Engineer to help protect Supernova's financial technology platform and enterprise environment. This senior individual-contributor role combines proactive threat hunting, detection engineering, incident response, and ownership of critical security technologies and infrastructure.

The successful candidate will be a trusted technical leader capable of operating independently, making sound risk-based decisions, and leading complex security projects from requirements and design through implementation, testing, documentation, and ongoing operation. You will work across endpoint, identity, network, cloud, application, and SaaS environments to identify threats, strengthen controls, and continually improve Supernova's security posture.

This role is well suited for someone who enjoys both investigating sophisticated security activity and building the systems, integrations, and processes needed to prevent, detect, and respond to it.

• Run hypothesis-driven and intelligence-led threat hunts across endpoint, network, identity, cloud, email, application, and SaaS telemetry, analyzing large datasets to surface suspicious behavior, control gaps, and emerging attack techniques.
• Turn threat intel and adversary TTPs into hunt hypotheses and detection logic; build and tune SIEM queries, correlation rules, dashboards, and alerts aligned to MITRE ATT&CK.
• Convert hunt findings and incident lessons into durable detections, prevention controls, and playbooks; continuously evaluate detection coverage, false-positive rates, and telemetry quality.
• Track emerging threats relevant to financial services, cloud, and software supply chains.

• Design, implement, test, and own security technologies end-to-end, including SIEM, EDR/XDR, IDS/IPS, firewalls, WAF, vulnerability management, email security, identity protections, and automation, from requirements and design through deployment, documentation, post-implementation validation, and ongoing operation.
• Strengthen security across AWS, Microsoft 365, Entra , Windows, macOS, Linux, containers, and SaaS, partnering with infrastructure, IT, and engineering teams.
• Improve endpoint and identity controls: secure configuration, conditional access, least privilege, account lifecycle, and credential hygiene.
• Maintain documentation, standards, and runbooks for owned systems; manage vendor relationships.

• Act as the senior technical escalation point and lead incident response, including triage, scoping, containment, eradication, recovery, evidence preservation, root-cause analysis, and lessons learned across endpoint, identity, network, cloud, email, and application environments.
• Build and test IR playbooks for high-risk scenarios.
• Lead vulnerability management, including identification, validation, risk-based prioritization, remediation coordination, retesting, and closure, partnering with system owners to track risk through resolution.
• Coordinate security assessments, pen testing, and adversary simulation as needed.
• Build scripts, integrations, and automated workflows (Python, Power Shell, APIs) to improve visibility and reduce manual effort.
• Establish security metrics (detection coverage, remediation performance, incident trends) and use them to drive…