Security Engineer

Execute and enforce Bright Machines’ day-to-day information security program across corporate IT, platform, and product environments, including ISO 27001:2022 maintenance and customer security due diligence.

Responsibilities

• Run day-to-day information security operations across corporate IT, platform, and product environments in partnership with the Global IT Director (security policy and strategy owner).
• Maintain the existing ISO 27001:2022 certification: manage evidence collection, conduct internal audits, drive corrective actions, and support annual surveillance and recertification audits.
• Complete customer security due diligence: submit security questionnaires (including SIG and CAIQ), support customer audits, and track contractual security requirements with collaboration from Legal and Sales as needed.
• Collaborate with Platform Engineering to incorporate application security into the SDLC, including threat modeling support, secure code review guidance, and operation of SAST/DAST/SCA tooling.
• Own vulnerability management for applications and platform infrastructure: perform scanning, triage findings, and drive remediation with engineering teams to meet SLA.
• Coordinate third-party penetration tests and security assessments, ensuring findings are tracked through to closure.
• Partner with the Infrastructure Engineer on security posture for network and compute infrastructure, including EDR/managed SOC and network IDS/IPS controls, and keep application and platform controls aligned with network security architecture.
• Support security incident response: help maintain the IR plan, participate in investigations, and run periodic tabletop exercises.
• Support identity and access governance for corporate and platform systems, including access reviews, certifications, and MFA/SSO enforcement with IT Engineering.
• Conduct security risk assessments for new vendors, tools, and third-party integrations.
• Maintain security policies and standards and deliver employee security awareness training (including phishing simulations), aligned to direction from the Global IT Director.
• Track and report security posture, risk, and compliance status to the Global IT Director.
• Assist with preparation for future compliance initiatives (for example, SOC 2 Type II) as prioritized by leadership.

Requirements

• 5+ years of experience in security engineering, IT security, application security, or a closely related role.
• Experience maintaining an existing ISO 27001 ISMS (evidence collection, internal audits, surveillance/recertification support). Building from scratch is not required.
• Working knowledge of application security fundamentals (including OWASP Top 10 and secure SDLC practices) and hands-on experience with SAST/DAST/SCA tooling such as Snyk, Semgrep, Checkmarx, and Burp Suite.
• Proficiency in a scripting language (example: Python) for security automation, plus strong interest in infrastructure-as-code (example: Terraform, Ansible) to codify and enforce security controls.
• Familiarity with GRC platforms for compliance evidence and monitoring.
• Basic cloud security literacy: AWS, Azure, and/or GCP (IAM, network security groups, encryption, logging and monitoring).
• Comfort completing customer security questionnaires and participating in customer-facing security discussions under direction.
• Familiarity with EDR/managed SOC platforms and comfort participating in security operations and detection/response workflows.
• Excellent written and verbal English communication skills, with the ability to collaborate with IT, Platform Engineering, Software Development, and Delivery stakeholders.
• Execution-focused security practitioner in a lean IT environment, partnering closely with the Global IT Director, Infrastructure Engineer, Platform Engineering, and staff IT Engineers.

Technologies

• ISO 27001:2022, ISO 27001
• OWASP Top 10
• SAST, DAST, SCA
• Snyk, Semgrep, Checkmarx, Burp Suite
• Python, Terraform, Ansible
• GRC platforms
• AWS, Azure, GCP
• EDR, managed SOC
• Network IDS/IPS
• SOC 2 Type II
• SIG, CAIQ
• MFA/SSO

It would be great if you had

• Security certifications such as Security+, GSEC, or CCSP.
• Experience in manufacturing, industrial, IoT, or OT/ICS security environments.
• Exposure to penetration testing engagements, hands-on or coordinating with external testers.
• Familiarity with Zero Trust architecture principles.
• English language proficiency.

• Location: Burlingame, CA (onsite)
• Salary: USD 170,000 - 200,000 per year