Cybersecurity & QA Engineer

LeanSite is seeking a hands-on Cybersecurity & QA Engineer to build a structured quality assurance program across product surfaces and to own application security end to end, including vulnerability management and secure release practices. The role spans QA and test automation as well as application security across web, mobile, and internal admin systems.

Key Responsibilities

• Build and own the test strategy across FM Portal, Workforce Portal, LeanSite Agent mobile app, and Admin Portal.
• Create test plans and test cases from user stories and acceptance criteria, partnering with Product from refinement through release.
• Build, maintain, and run regression suites ahead of every release.
• Introduce automated testing (end-to-end, API, and mobile) and integrate it into the CI/CD pipeline so it executes on every build.
• Test complex end-to-end workflows, including recurring and bulk work orders, offline mode, multi-channel notifications, vendor check-in/check-out, and payments.
• Test AI features, including Vera, with focus on accuracy, consistency, and safe behavior.
• Log, triage, and track defects in Jira, including verification of fixes before they ship.
• Define release quality gates with the Head of Engineering and the Release Owner, and sign off on release readiness.
• Support user acceptance testing with internal teams and clients ahead of major rollouts.
• Own platform application security by running vulnerability assessments, coordinating penetration tests, and driving remediation with Engineering.
• Review authentication, authorization, and role-based access control, including data isolation across client organizations.
• Embed security into the development lifecycle through secure code review support, dependency and secrets scanning, and automated security checks in CI/CD.
• Review the security of third-party integrations and infrastructure, including payment processors, email and SMS providers, cloud hosting, database, and DNS.
• Assess AI-specific risks in Vera, including prompt injection and unintended data exposure.
• Lead security incident response, including triage, containment, root cause analysis, and post-incident review.
• Maintain security policies and documentation, and respond to enterprise client security questionnaires and reviews.
• Help establish groundwork for compliance frameworks such as SOC 2 as the enterprise customer base grows.

Requirements

• 3+ years of experience in QA engineering, application security, or a combination of both, ideally in a SaaS environment.
• Hands-on experience testing web applications and APIs, including writing structured test plans and test cases.
• Experience with at least one test automation framework (e.g., Playwright, Cypress, or Selenium) and API testing tools (e.g., Postman).
• Working knowledge of the OWASP Top 10 and common web and API vulnerabilities.
• Experience with security testing tools such as Burp Suite or OWASP ZAP.
• Understanding of authentication and authorization patterns, including OAuth, JWT, OTP sign-in, and role-based access control.
• Working familiarity with JavaScript and Node.js: enough to read code, write test scripts, and review changes.
• Experience integrating automated checks into CI/CD pipelines.
• Clear written communication for bug reports, test documentation, and security findings that engineers and non-technical stakeholders can act on.
• Experience working in Jira or a similar issue tracker within an agile team.

Technologies

Node.js, Express, MongoDB Atlas, Playwright, Cypress, Selenium, Postman, OWASP Top 10, Burp Suite, OWASP ZAP, OAuth, JWT, OTP, JavaScript, CI/CD, Jira, SOC 2

Benefits

• Opportunity to build quality and security from the ground up at a growing AI-native SaaS company.
• Direct impact on a product used daily by enterprise facilities teams and field technicians.
• Close collaboration with Product, Engineering, and leadership, with real ownership over how the team ships.

Nice to Have

• Mobile testing experience, especially React Native apps on iOS and Android (e.g., Detox or Appium).
• Experience with MongoDB, including NoSQL injection risks and database access controls.
• Certifications such as CompTIA Security+, CEH, OSCP, or ISTQB.
• Experience supporting SOC 2, ISO 27001, or similar compliance programs.
• Experience testing AI or LLM-powered features.
• Exposure to payments integrations and PCI DSS.
• Load and performance testing experience (e.g., k6 or JMeter).
• Background in facilities management, property technology, or field service software.

Application Questions

• A few things about you *
• A brief explanation of a complex technical problem you've solved — distributed systems, performance, AI integration, IOT or anything that required genuine engineering thinking *
• A link to your GitHub or a live portfolio of personal projects.
• LinkedIn Profile URL (Required)

Location and Salary

• Location: Buffalo, NY (onsite)
• Salary: USD 75,000 - 115,000 per year
• Minimum Experience: 3 years
• Work Location: In person