Software Engineer, Security Focus

Job Description:

• Own end-to-end remediation of vulnerabilities surfaced by penetration tests and other security assessments, from triage through verified fix
• Examine front-end/back-end session traffic using browser-based code inspection tools and identify excessive or sensitive information exposure
• Translate security findings into concrete, testable requirements in Technical Requirements Documents (TRDs)
• Review and harden session management practices across the application stack
• Implement fixes across Ruby on Rails, React, AWS, Fargate, and containerized services
• Assess and secure real-time and API-driven features, including Pusher, AnyCable, and RESTful APIs
• Document vulnerabilities, root causes, remediation steps, and verification results
• Contribute security context and vocabulary to FedRAMP-related discussions and requirements
• Design, build, and ship features across the Ruby on Rails back end and React front end
• Apply secure-by-design practices to new development
• Participate in code reviews, testing, and technical design discussions

Requirements:

• 5+ years of hands-on software engineering experience, with broad full-stack work across multiple applications and technology layers
• Working proficiency in Ruby on Rails and React
• Experience with containerized environments, AWS, and Fargate
• Solid API experience, including RESTful API design and security considerations
• Hands-on experience with Pusher and AnyCable, or comparable real-time messaging technologies
• Knowledge of Ruby data models and how schema and query design affect performance and scalability
• 5+ years of experience in a security engineering or closely related role
• Proven experience remediating vulnerabilities identified through penetration testing
• AWS Security certification(s) (e.g., AWS Certified Security – Specialty)
• General familiarity with FedRAMP
• Comfortable using browser developer/code inspection tools to inspect network and session traffic
• Able to identify excessive information exposure between backend and frontend and explain the risk clearly
• Able to translate security findings into actionable design requirements for the TRD
• Solid understanding of session management principles and common pitfalls
• Strong written communication skills, with the ability to document vulnerabilities, remediations, and technical requirements clearly for engineering and non-engineering audiences
• Experience with Pulumi for infrastructure as code (nice to have)
• Python experience (nice to have)
• SQL skills (nice to have)
• Active or eligible for security clearance (nice to have)

Benefits: