Security Engineer

The Role

As a Security Engineer at Drivetrain, you'll own and evolve our security posture across product, infrastructure, and internal tooling. You'll work closely with Engineering, IT, and Compliance to make sure security is built into how we ship — not bolted on after the fact. This is a hands-on role for someone who wants to build systems and processes, not just write policy.

What You'll Do

Design, implement, and maintain security controls across cloud infrastructure (AWS/GCP), CI/CD pipelines, and internal systems

Lead application security efforts: threat modeling, secure code review, and integrating SAST/DAST tooling into the development lifecycle

Own vulnerability management — triage, prioritize, and drive remediation of findings from scans, pen tests, and bug bounty reports

Monitor for and respond to security incidents; build and maintain incident response runbooks

Manage identity and access controls (SSO, RBAC, least-privilege enforcement) across internal and customer-facing systems

Support customer security questionnaires, audits, and certifications (e.g., SOC 2, ISO 27001)

Partner with engineering teams to embed secure-by-design practices into new features and services

Evaluate and implement security tooling (secrets management, endpoint protection, cloud security posture management)

Educate the broader team on security best practices and champion a security-first culture

What We're Looking For

2+ years of experience in security engineering, application security, or a related infrastructure/security role

Strong understanding of cloud security fundamentals (AWS or GCP), network security, and IAM

Experience with secure SDLC practices — code review, dependency scanning, CI/CD pipeline security

Familiarity with common frameworks and standards (OWASP Top 10, SOC 2, ISO 27001, GDPR)

Hands-on scripting/automation skills (Python, Go, or similar) for building internal security tooling

Experience responding to and documenting security incidents

Clear communicator who can translate security risk into terms non-security stakeholders understand

Nice to Have

Experience securing a SaaS product handling sensitive financial data

Prior experience leading a SOC 2 Type II or ISO 27001 audit from the engineering side

Familiarity with container security (Docker/Kubernetes) and IaC scanning (Terraform)

Relevant certifications (OSCP, CISSP, CCSP) — nice signal, not required