Security Engineer, Corporate Security

Cape is America’s privacy-first mobile carrier, founded in 2022 to enhance global wireless privacy. The company is seeking an experienced Security Engineer to design, implement, and maintain security measures while collaborating with various teams to reduce risk and enhance the organization's security posture.

Responsibilities:

• Design, implement, and manage security controls and policies across corporate IT systems, focusing on the confidentiality, integrity, and availability of employee, customer, and business data
• Own and mature identity and access management (IAM/SSO/MFA), endpoint security (EDR, MDM), and email/network security (phishing defense, DLP, firewalls, VPN) across the organization
• Perform comprehensive security assessments of corporate systems and vendors to identify vulnerabilities, assess risk, and recommend actionable mitigation strategies
• Establish governance, guardrails, and monitoring for emerging employee tooling, including the associated data-handling, access, and third-party risks
• Own the vulnerability management lifecycle across the corporate fleet: scanning, risk-based prioritization, remediation and patch SLAs, and closure tracking across endpoints and internal systems
• Lead security awareness and phishing simulation programs to build an organization-wide culture of security
• Contribute to compliance and audit efforts as needed, lending security context where it helps the business move faster
• Assess and manage third-party/vendor security risk, including security questionnaires, contract reviews, and ongoing vendor monitoring
• Assist in running and addressing findings from penetration tests, red team exercises, and internal audits, ensuring prompt and effective remediation
• Stay informed about the latest security threats, vulnerabilities, and compliance mandates affecting corporate environments; provide strategic guidance on technologies and best practices
• Investigate security incidents and insider-threat concerns in partnership with HR, Legal, and IT as needed
• Raise the security bar across the company by mentoring engineers and partners on secure practices, fostering a culture of security awareness and continuous improvement
• Collaborate with stakeholders to integrate security requirements effectively into IT projects and broader business initiatives

Requirements:

• Design, implement, and manage security controls and policies across corporate IT systems, focusing on the confidentiality, integrity, and availability of employee, customer, and business data
• Own and mature identity and access management (IAM/SSO/MFA), endpoint security (EDR, MDM), and email/network security (phishing defense, DLP, firewalls, VPN) across the organization
• Perform comprehensive security assessments of corporate systems and vendors to identify vulnerabilities, assess risk, and recommend actionable mitigation strategies
• Establish governance, guardrails, and monitoring for emerging employee tooling, including the associated data-handling, access, and third-party risks
• Own the vulnerability management lifecycle across the corporate fleet: scanning, risk-based prioritization, remediation and patch SLAs, and closure tracking across endpoints and internal systems
• Lead security awareness and phishing simulation programs to build an organization-wide culture of security
• Contribute to compliance and audit efforts as needed, lending security context where it helps the business move faster
• Assess and manage third-party/vendor security risk, including security questionnaires, contract reviews, and ongoing vendor monitoring
• Assist in running and addressing findings from penetration tests, red team exercises, and internal audits, ensuring prompt and effective remediation
• Stay informed about the latest security threats, vulnerabilities, and compliance mandates affecting corporate environments; provide strategic guidance on technologies and best practices
• Investigate security incidents and insider-threat concerns in partnership with HR, Legal, and IT as needed
• Raise the security bar across the company by mentoring engineers and partners on secure practices, fostering a culture of security awareness and continuous improvement
• Collaborate with stakeholders to integrate security requirements effectively into IT projects and broader business initiatives
• Bachelor's degree in Computer Science, Information Security, or a related field (or equivalent experience). Advanced degrees or certifications (e.g., CISSP, GIAC, Security+, CISM) are advantageous
• A minimum of 5 years of experience in information security, with meaningful experience across corporate/IT security domains (identity, endpoint, network, GRC)
• Deep understanding of enterprise identity providers and SSO/MFA platforms, endpoint/EDR tooling, MDM platforms, and email security tooling
• Working knowledge of common compliance frameworks (e.g., SOC 2, ISO 27001)
• Familiarity with government/public-sector security frameworks (FedRAMP, FISMA, NIST SP 800 series, CJIS) is a plus, given Cape's government-facing customer base
• Working knowledge of consumer privacy regulations (GDPR, CCPA, and other regional privacy laws) as they apply to handling customer data
• Exposure to secure software development lifecycle (SSDLC) practices and partnering with engineering on secure design reviews
• Proficiency in scripting or automation (Python, shell scripting, or similar) to streamline security operations and reporting
• Familiarity with vendor/third-party risk management processes and tooling
• Solid knowledge of network security, encryption technologies, and secure business-system configuration
• Excellent analytical skills for identifying and mitigating complex security vulnerabilities and risks
• Strong communication and leadership abilities, capable of working collaboratively across teams and effectively conveying technical information to non-technical stakeholders
• Organized and able to manage multiple priorities in a dynamic, fast-paced environment