Associate Security Engineer (Remote)

ezCater is the #1 food tech platform for workplaces in the US, helping organizations manage food needs and order from restaurants nationwide. The Associate Security Engineer will help improve the company’s security posture across products, systems, data, and business operations through security reviews, automation, vulnerability management, incident response, data and AI security, and GRC activities.

Responsibilities:

• Support security reviews, architecture discussions, threat modeling, and risk assessments for products, services, integrations, and technology partners
• Help identify and remediate application, infrastructure, identity, configuration, and data security risks
• Partner with Engineering and IT teams to integrate security into the software and systems lifecycle
• Translate security requirements into practical controls, secure configurations, workflows, monitoring, or policy-as-code where appropriate
• Provide clear, actionable guidance to technical and non-technical stakeholders
• Identify manual, repetitive, or error-prone security processes and recommend practical improvements
• Build or improve lightweight automation, scripts, dashboards, workflows, and integrations that make security work more reliable and scalable
• Use APIs, cloud platforms, security tools, and data analysis to investigate issues and improve visibility
• Contribute to monitoring and alerting that helps the team detect, prioritize, and respond to security risks
• Document technical decisions, procedures, runbooks, and implementation guidance
• Help triage, investigate, prioritize, and track vulnerabilities through remediation
• Support incident response activities, including investigation, containment, remediation, documentation, and follow-up improvements
• Assist with security configuration reviews, access reviews, and other recurring activities that reduce operational risk
• Help improve the quality of security findings by connecting technical severity, exploitability, business impact, and practical remediation paths
• Contribute to team metrics, operating cadences, and continuous-improvement activities
• Help maintain and improve technical and operational controls for data protection, access, sharing, retention, classification, and handling
• Assist with evaluating and securing AI-enabled tools and workflows, including access, data protection, monitoring, usage controls, and safe adoption practices
• Support control documentation, evidence collection, testing, remediation tracking, and audit readiness for SOC 2, PCI-DSS, SOX, ITGC, and internal security requirements
• Help identify gaps between documented requirements and how systems or teams operate in practice
• Work with GRC and partner teams to make security and compliance requirements clearer, more observable, and easier to implement

Requirements:

• 1–3 years of experience in security engineering, application security, cloud security, IT, GRC, security operations, software engineering, or a related field; equivalent practical experience is welcome
• Foundational understanding of security concepts such as access control, secure software development, vulnerability management, identity, network or cloud security, data protection, incident response, or risk management
• Basic experience or strong interest in scripting, APIs, automation, data analysis, cloud platforms, AI tooling, or security engineering workflows
• Ability to investigate questions, identify missing information, troubleshoot issues, and follow problems through to resolution
• Strong attention to detail and the ability to organize technical findings, tasks, documentation, and follow-up across multiple workstreams
• Comfort working with developer workflows, ticketing systems, documentation platforms, cloud services, security tools, or GRC tools
• Ability to explain security risks and recommendations clearly to technical and non-technical partners
• A collaborative, service-oriented approach and a proactive, curious, and pragmatic mindset
• A continuous-learning mindset and interest in developing depth across multiple security domains
• Ability to travel up to 5 days per quarter for Together Weeks, team gatherings and other events, when applicable