[Hiring] Senior Security Engineer @Suralink Inc

Role Description

As our Senior Security Engineer, you will own our entire security posture. We are a growing company and we need someone who can plan our security roadmap and execute the technical work to back it up. You will bridge the gap between high-level risk management and hands-on engineering, ensuring our infrastructure, applications, and corporate data remain secure.

Key Responsibilities:

• Security Architecture & Planning
  • Define the roadmap: Build and maintain our annual security strategy, compliance goals, and risk management frameworks.
  • Vendor & tool management: Evaluate, select, and budget for security tooling without over-engineering our stack.
  • Compliance & audits: Own or prepare the company for relevant compliance frameworks (e.g., SOC 2 Type II, or GDPR).
  • Incident response planning: Create, test, and maintain our Incident Response (IR) and Disaster Recovery (DR) playbooks.
• Hands-on Execution & Engineering
  • Cloud & infrastructure security: Harden our cloud environments (AWS/GCP), manage IAM policies, and configure network security.
  • AppSec & CI/CD: Integrate automated security scanning (SAST/DAST) into our deployment pipelines and conduct code reviews.
  • Endpoint & corporate security: Deploy and manage our MDM, MDR solutions, and identity providers.
  • Monitoring & triage: Set up log aggregation and investigate security alerts and anomalies.
  • Vulnerability and patch management programs, including risk-based prioritization.
• Culture & Enablement
  • Security awareness: Run phishing simulations and train a remote workforce on security best practices.
  • Trust & sales enablement: Unblock sales by answering security questionnaires and ensure that we follow up what we promised our customers.

Qualifications

• 4+ years in dedicated cybersecurity roles, ideally with experience as a "Security Team of One" or at a scaling startup (50–500 employees).
• Cloud Infrastructure: Hands-on experience with at least one major cloud provider (AWS, GCP, Azure).
• Security Tooling: Experience with modern stack tools (e.g., Wiz, Datadog, Elastic, SentinelOne).
• Code/Scripting: Ability to write scripts (Python, Bash, Go, Javascript, or similar) to automate security tasks and integrate APIs.
• Compliance: Direct experience leading or heavily contributing to a SOC 2 audit.
• Autonomy: Comfort working in a fast-paced environment with minimal supervision.

Requirements

• Experience with GRC automation platforms (Vanta, Drata) and with additional frameworks such as ISO 27001, HIPAA, PCI DSS, or GDPR.
• Infrastructure-as-code and container security (Terraform, Kubernetes, Docker), including policy-as-code and guardrails.
• Endpoint and device management (Jamf, Kandji, Intune) and corporate IT security fundamentals.
• Relevant certifications (AWS Security Specialty, CISSP, OSCP, GCIH, or similar). Familiarity with securing AI/LLM-enabled products and internal AI tool usage.

Competencies

• Can explain risk to executives and engineering teams alike.
• Ability to recognize existing gaps and make remediation recommendations.
• Pragmatic Mindset: Ability to balance strict security practices with business agility and developer velocity.
• Proven track record of building security programs from scratch, not just maintaining existing ones.

Benefits

• Remote-friendly policy.
• Medical/vision/dental insurance.
• Flexible PTO policy and ten paid holidays.
• Parental leave.
• Professional development allowance.
• Community involvement.