Security Engineer

About Your Role 

As a Mid-Level Security Engineer at QGenda, your primary responsibility will be to leverage your robust AWS security expertise to secure cloud-based applications, infrastructure, and customer data against evolving threats. You will collaborate closely with Product, Development, and Infrastructure Teams, integrating AWS security tools and processes into our SDLC while advancing the organization’s overall security posture. This role offers significant opportunities for professional development and direct impact on our evolving security environment.

How You’ll Make an Impact 

• Assist in the design, implementation, and management of AWS-native security solutions such as GuardDuty, SecurityHub, Inspector, and Config to secure our infrastructure and systems.
• Aid in automating and scaling security processes, integrating best practices and tools (e.g., SAST, DAST, SCA) into the Software Development Life Cycle (SDLC) through close collaboration with development teams.
• Lead vulnerability management, overseeing scanning, risk prioritization, and coordination of timely remediation efforts, including patching.
• Apply AWS Cloud security best practices to monitor, detect, respond, and mitigate risks effectively.
• Help Develop and maintain security policies, standards, and procedures aligned with frameworks like NIST, ISO 27001, and SOC 2.
• Support security audits and compliance efforts for regulatory requirements such as HIPAA, PCI DSS, and FedRAMP.
• Offer security awareness training and guidance to staff, and clearly report security metrics to management.

Who You Are 

• Extensive hands-on expertise with AWS security tools and concepts, including IAM, Key Management Service (KMS), AWS Organizations, and encryption techniques.
• Proven ability to design and deploy secure architectures in AWS, including multi-account structure configurations.
• Hands-on experience with DevSecOps practices and securing CI/CD pipelines, including SCA, SAST, and IaC tools.
• Proficiency in scripting and automation (Python, Bash, PowerShell Core) to drive efficiency and scalability in security operations.
• Expertise in vulnerability management, including hands-on experience with scanning tools (e.g., Nessus, Qualys) and a proactive approach to risk prioritization and remediation.
• Familiarity with Cloud Native Application Protection Platform (CNAPP) solutions (e.g., Wiz, Sysdig, Orca, Lacework).
• Knowledge of industry compliance standards and frameworks (e.g., NIST, ISO 27001, HIPAA, PCI DSS, SOC 2) and their practical application.
• Demonstrated experience in incident response coupled with exceptional problem-solving and composure under pressure.
• Excellent communication and collaboration skills, vital for partnering with cross-functional teams and advocating for security best practices.

Experience You Bring 

• Bachelor's degree from an accredited college or university or equivalent industry experience.
• 2-4+ years of experience in security engineering, security operations, or related fields.

Not Required, but Nice to Have

• Relevant certifications such as CySA+, CEH, OSCP, E|CDE, or AWS Security Specialty.
• Deep knowledge of container security (e.g., Docker, Kubernetes).
• Familiarity with: zero-trust architecture principles, OpenSSF, CNCF, MITRE ATT&CK, Threat Modeling, OWASP, CIS, CVSS, DLP, and IAM.