Posted today · be early
Security Engineer
Firmable
IndiaremotePosted 1 day ago
Skill Required
Security-EngineerCloud-Security-EngineerInformation-Security-EngineerIT-Security-EngineerCybersecurity-EngineerSecurity-EngineeringSecurity EngineersecuritySOCCloud SecurityEngineeringISO 27001automationObservabilityCryptographysimilar)writtenCloudRustAWSIAMandAIFulltime
Key highlights
- Experience: 2–5 years
- Location: Fully remote, open globally
- Requirement: Direct SOC 2 or ISO 27001 exposure
- Benefit: Competitive compensation and flexible hours
Role overview
As our Security Engineer, you'll own the day-to-day execution of the security controls and policies that keep Firmable compliant against SOC 2 (all five TSC) and ISO 27001:2022. This is a hands-on operational role where you implement, monitor and continuously tighten the controls auditors and customers actually test against, serving as the operational backbone of customer trust in how Firmable handles data.
Responsibilities
- SOC 2 & ISO 27001 execution: implement and maintain controls across infrastructure, applications and internal systems; close gaps as they're identified
- Security policy enforcement: put information security policy into daily practice across engineering and business teams, covering access control, data classification, incident response, vendor risk and change management
- Continuous control monitoring: recurring access reviews, log reviews, vulnerability scans and patch cadence checks; organise evidence ahead of audits
- Vulnerability management: triage scanner findings, coordinate remediation with engineering, verify closure
- Identity & access management: onboarding/offboarding, least-privilege and MFA enforcement, periodic access recertification
- Monitoring & incident response: watch security alerts and logs, triage and escalate per the incident response plan
- Risk & vendor management: maintain the risk register and third-party risk assessments, track remediation to closure
- Audit readiness: prepare evidence for annual assessments and respond to customer security questionnaires
- Security awareness: run employee training and phishing simulations
- Secure cloud configuration: partner with engineering on least-privilege IAM, encryption at rest and in transit, and secrets management (AWS)
- ~90% hands-on execution: control implementation, continuous monitoring, evidence collection, vulnerability and access management
- ~10% cross-functional: partnering with engineering on secure cloud config and shaping the program as it scales across frameworks
Requirements
- 2–5 years in security engineering, cloud security or infrastructure security, ideally with direct SOC 2 or ISO 27001 exposure
- Working knowledge of the SOC 2 Trust Services Criteria and how technical controls map to them
- Hands-on cloud security fundamentals (AWS preferred): IAM, logging/monitoring, vulnerability scanning
- Comfortable executing policy day to day (access reviews, evidence collection, remediation tracking), not just writing it
- Clear written communication and comfortable working async across time zones with a distributed team
Nice to have
- Familiarity with GRC automation platforms (Vanta, Drata or similar)
- Relevant certification (Security+, CySA+, ISO 27001 Lead Implementer, or progress toward CISA/CISSP)
Benefits
- Competitive compensation
- Flexible hours
- Multi-framework exposure from day one: a live SOC 2 and ISO 27001 program, not a single-framework box-tick
- Real ownership: the controls you run directly protect the trust 1,000+ customers place in Firmable's data
Additional details
- Report into the Security & Compliance team
- Fully remote and open globally
- Working closely with a distributed Security and Engineering team across time zones
- Fast-moving, AI-native product team
- Originally posted on Himalayas
