Senior Security Operations Engineer

SunCore Digital is seeking a hands-on Senior Security Operations Engineer to assess and improve the security of their applications and environments. The role involves establishing security standards, investigating risks, and reviewing security-impacting implementations to ensure robust security practices across the organization.

Responsibilities:

• Assess the current security posture across web applications, Flutter mobile applications, APIs, backend services, cloud infrastructure, repositories, CI/CD, databases, and integrations
• Inventory externally accessible services and endpoints
• Identify vulnerabilities, insecure defaults, excessive permissions, unmanaged credentials, and control gaps
• Distinguish confirmed findings from suspected risks and unassessed areas
• Prioritize findings based on exploitability, potential impact, exposure, and launch relevance
• Define remediation requirements and work with system owners, who implement and maintain application- and service-specific fixes. Implement shared security controls where the control belongs to the security function
• Verify that critical findings are resolved effectively
• Review access to cloud accounts, repositories, databases, CI/CD systems, production environments, and third-party services
• Identify former employee, contractor, shared, excessive, or undocumented access
• Establish least-privilege and access-review practices
• Review service accounts, machine identities, API credentials, and privileged roles
• Define and harden credential lifecycle requirements, and work with DevOps, platform staff, and system owners to implement appropriate issuance, storage, rotation, revocation, and emergency-access mechanisms
• Ensure critical access activity is logged where appropriate
• Support role-based access and authorization reviews
• Review authentication, authorization, session management, permissions, and data isolation
• Assess exposed APIs, input handling, file processing, sensitive-data handling, and administrative functions
• Independently assess high-risk negative-access paths and direct access to restricted endpoints
• Work with QA and developers to convert repeatable security scenarios into regression coverage owned by the applicable delivery team
• Review changes involving sensitive workflows or new public exposure
• Help establish secure coding and review expectations
• Support threat modeling for critical workflows and material architectural changes
• Assess mobile authentication, session handling, secure storage, API access, application permissions, logging, and sensitive-data exposure
• Review risks related to device storage, screenshots, notifications, local caches, and mobile configuration
• Work with the Mobile QA Engineer and mobile developers on security-related testing
• Review mobile release practices where they affect application security
• Define, implement, and harden security-specific automation, including dependency scanning, secret scanning, static analysis, vulnerability scanning, and container or infrastructure scanning where appropriate; establish the long-term owner for each shared control before handoff
• Define security policies, rules, and acceptance thresholds; work with DevOps to integrate shared controls into CI/CD and with repository owners to maintain application-specific configuration
• Establish actionable security gates based on severity and context, while system owners remain responsible for remediation
• Avoid creating low-value controls that block delivery without reducing material risk
• Improve security finding visibility and reporting
• Define exception and escalation procedures
• Track critical remediation through verification
• Review security-impacting SRE and Disaster Recovery implementations before production adoption
• Evaluate changes involving: Privileged automation, Service accounts, Secrets, Backup data, Recovery access, Network or firewall configuration, Infrastructure permissions, Failover paths, Sensitive logging or monitoring
• Review DevOps, dashboard, and internal-tooling changes when they affect access, production data, infrastructure, or security controls
• Validate that operational improvements do not introduce avoidable security exposure
• Establish security monitoring and escalation requirements
• Develop security incident-response procedures and runbooks
• Define initial security incident severity and notification paths
• Investigate security events and suspicious activity
• Support evidence preservation and technical incident analysis
• Conduct or coordinate security exercises
• Track post-incident corrective actions
• Ensure security runbooks are tested by qualified staff
• Identify where sensitive, personal, financial, or operational data is stored and transmitted
• Review encryption in transit and at rest
• Assess retention, deletion, export, logging, and access behavior
• Review third-party services that receive code, credentials, operational data, or sensitive information
• Support vendor security review based on business risk
• Help identify security and privacy obligations that require legal or compliance input
• Work with developers to remediate application findings
• Work with SRE on logging, monitoring, incident readiness, and security-relevant reliability controls
• Work with the Disaster Recovery and Resilience Engineer on backup, restoration, emergency access, and recovery security
• Define security requirements for CI/CD and shared infrastructure; work with DevOps and platform staff to implement them, and with system owners to maintain application-specific configuration
• Work with QA on permissions, authorization, data isolation, and regression scenarios
• Provide clear technical findings and risk information to leadership
• Inventory production access, service accounts, secrets, and publicly accessible endpoints
• Review former employee, contractor, and shared access
• Establish and harden shared dependency- and secret-scanning capabilities, coordinate CI/CD integration with DevOps, and assign remediation ownership to the applicable repository teams
• Assess authentication, authorization, and customer-data isolation
• Review critical cloud and infrastructure permissions
• Identify launch-critical security findings
• Establish security review triggers for high-risk changes
• Implement initial security monitoring and incident procedures
• Review SRE and recovery mitigations that affect production security
• Create a factual security-readiness assessment

Requirements:

• Five or more years of experience in security engineering, DevSecOps, cloud security, application security, security operations, or a comparable role
• Hands-on experience remediating security issues
• Experience securing cloud-hosted applications and infrastructure
• Experience reviewing authentication, authorization, permissions, and data isolation
• Experience with CI/CD security integration
• Experience with vulnerability, dependency, secret, and static-analysis tooling
• Strong understanding of identity, access, service accounts, secrets, and least privilege
• Experience reviewing web applications and APIs
• Familiarity with mobile application security
• Experience with security monitoring and incident response
• Ability to assess third-party and operational security risks
• Strong technical documentation and communication skills
• Ability to distinguish confirmed vulnerabilities, suspected risks, and unassessed areas
• Comfort working in a small organization where security practices are still being established
• Experience preparing a platform for its first external users
• Experience establishing security practices in a startup or small engineering organization
• Familiarity with crypto, fintech, digital assets, KYC, AML, or payment-related systems
• Experience with Flutter or mobile application security
• Experience securing disaster-recovery, backup, or privileged automation systems
• Experience with infrastructure as code or containerized platforms
• Experience in a remote, asynchronous environment