Senior Security Engineer

The Senior Security Engineer will secure IcyBox, its customers, and their data by driving security across mobile and web applications, cloud infrastructure, and internal systems. This is an in-person role in New York, NY, five days a week.

Role Focus

Own security outcomes end-to-end, from vulnerability management and secure development to incident detection and response. The role also includes threat modeling and support for compliance efforts covering PCI DSS and privacy laws, while enabling engineers with practical security guidance.

Key Responsibilities

• Identify and remediate vulnerabilities across mobile, web, and backend applications
• Secure AWS infrastructure, including access management, networking, and secrets handling
• Run threat modeling and security reviews for new features
• Embed security checks into CI/CD pipelines, including code scanning and dependency checks
• Lead incident detection and response activities, including logging, alerting, and incident playbooks
• Monitor security news and share relevant updates with the engineering team
• Reduce account takeover risk and prevent bots and abuse on the website and mobile app
• Manage penetration tests, bug bounty reports, and vendor security reviews
• Support compliance initiatives such as PCI DSS and applicable privacy laws
• Provide training to engineers on secure coding practices

Required Qualifications

• 5+ years of experience in security engineering, application security, or cloud security
• Hands-on experience securing AWS environments
• Strong understanding of web and mobile application security, including the OWASP Top 10
• Ability to read and write code in at least one language such as Rust, Python, Go, or TypeScript
• Experience leading incident response
• Ability to communicate risk clearly and provide engineers with actionable fixes

Technologies

• AWS
• CI/CD
• Code scanning
• Dependency checks
• OWASP Top 10
• Rust
• Python
• Go
• TypeScript
• PCI DSS

Location and Compensation

• Location: New York, NY (onsite)
• Salary: USD 180,000 - 220,000 per year
• Experience: Minimum 5 years

Nice to Have

• Experience with production Rust, React, and React Native systems
• E-commerce or payments security experience, including PCI DSS
• Experience in fraud, bot, and account takeover prevention
• Experience with SIEM tools and detection engineering
• Certifications such as OSCP, CISSP, or AWS Certified Security – Specialty
• Experience as a first security hire or early member of a startup security team