Senior Security Engineer

Description:

BisectHosting is hiring a Senior Security Engineer to take ownership of security across our entire business, from infrastructure and application security to employee awareness and internal operations.

We're looking for someone who thrives in a fast-moving, startup-like environment, enjoys wearing multiple hats, and isn't afraid to get their hands dirty. You'll have the freedom and responsibility to identify risks, set priorities, and implement solutions without needing constant direction.

This is a highly hands-on role. One day you might be reviewing code for vulnerabilities, the next conducting penetration tests, securing internal tools, or training employees on social engineering risks. You'll work directly with engineering and leadership to build practical security measures that protect our customers, employees, and infrastructure without unnecessarily slowing down the business.

What you'll work on:

• Own and continuously improve security across applications, infrastructure, internal systems, and business operations
• Conduct security-focused code reviews, identify vulnerabilities, and work directly with engineers to implement fixes
• Perform hands-on penetration testing and vulnerability assessments across web applications, APIs, networks, and infrastructure
• Secure internal and external APIs through proper authentication, authorization, access controls, and credential management
• Own identity and access management (IAM), including employee permissions, role-based access controls, least-privilege policies, and regular access audits
• Establish practical security standards for internal tools, third-party services, cloud environments, and production infrastructure
• Lead employee security awareness initiatives, including phishing simulations, social engineering testing, and security training
• Identify risks in everyday employee workflows and implement technical or procedural safeguards to reduce exposure
• Implement and maintain security monitoring, vulnerability scanning, threat detection, and incident response processes
• Build automated security checks into development workflows, including code scanning, dependency auditing, and CI/CD security controls
• Investigate security incidents, identify root causes, and implement preventative improvements
• Independently identify, prioritize, and execute security initiatives based on business risk and impact
• Work across departments to solve security problems, even when they fall outside traditional engineering responsibilities

Requirements:

What we're looking for:

• Strong professional experience in security engineering, application security, infrastructure security, or a similar role
• A self-starter who can manage their own time, establish priorities, and drive projects from identification through implementation
• Comfortable wearing multiple hats and taking responsibility for problems outside a narrowly defined job description
• Hands-on mentality with a willingness to investigate problems, write code, configure systems, and implement fixes personally
• Strong understanding of application security, secure coding practices, and common vulnerabilities such as those outlined by OWASP
• Experience with penetration testing, vulnerability assessments, and security testing tools
• Strong understanding of API security, authentication, authorization, OAuth, access tokens, and credential management
• Experience managing IAM, RBAC, MFA, SSO, and least-privilege access policies
• Strong Linux, networking, Docker, and cloud infrastructure security fundamentals
• Experience securing production applications, databases, internal tools, and cloud environments
• Familiarity with automated security tooling, including SAST, DAST, dependency scanning, and secrets detection
• Ability to evaluate human security risks, including phishing, social engineering, and unsafe employee practices
• Strong problem-solving skills and the ability to make practical security decisions with limited resources or incomplete information
• Ability to communicate security risks clearly to technical and non-technical employees
• Comfortable operating independently in a fast-paced environment with changing priorities and minimal bureaucracy
• Practical approach to security that balances risk reduction, usability, and business needs

Preferred Qualifications:

• Experience as an early security hire or owning security at a startup or growing technology company
• Experience securing hosting platforms, SaaS products, or large-scale infrastructure environments
• Experience with Cloudflare, AWS, and bare-metal infrastructure security
• Experience securing PHP/Laravel applications, REST APIs, and MySQL databases
• Familiarity with GitHub security workflows, automated pull request scanning, and software supply-chain security
• Experience conducting internal red-team exercises, phishing campaigns, and social engineering simulations
• Experience with SIEM platforms, intrusion detection, centralized logging, and threat intelligence
• Experience with endpoint security, device management, and employee onboarding/offboarding security processes
• Experience building security processes and tooling from the ground up
• Relevant security certifications such as OSCP, CISSP, GIAC, or equivalent demonstrated experience