Security Controls Engineer

What you'll do

• Translate legal, regulatory, and security framework requirements into actionable technical tasks for engineering teams.
• Manage the end-to-end vulnerability lifecycle across infrastructure, cloud, applications, containers, and third-party components.
• Integrate automated security scanning tools like SAST, DAST, and SCA into CI/CD pipelines.
• Coordinate remediation efforts across multiple security domains and DevOps teams to ensure consistent adoption.
• Develop dashboards to report vulnerability aging, SLA compliance, and risk exposure to senior leadership.
• Map vulnerability management practices to regulatory frameworks and collect evidence for audits.
• Automate playbooks and standardize templates to reduce manual triage effort and improve program maturity.

What we're looking for

• A degree in Information Technology or a related field with a focus on cybersecurity (preferred).
• 3+ years of experience in vulnerability management, security engineering, or security program delivery in cloud/software environments.
• Experience in cloud environments including AWS, Azure, or GCP and understanding of shared responsibility models.
• Working knowledge of regulatory security requirements and implementation of frameworks like ISO 27001, NIS2, SOC 2, GDPR, or PCI DSS.
• Ability to translate policy and control language into developer-ready user stories, acceptance criteria, and runbooks.
• Experience using work tracking tools such as Jira or Azure DevOps to create status reports and dashboards.
• Understanding of modern SDLC/DevOps practices including CI/CD, IaC, pipelines, and change management.
• A wry sense of humor (preferred).