Security Engineer

Join Bright Machines as a Security Engineer in Burlingame, CA (onsite) and help run a practical, day-to-day information security program across corporate IT, platform, and product environments. In this role, you will support ISO 27001:2022 maintenance, enable secure development with SDLC tooling, and coordinate customer security due diligence. You will partner closely with the Global IT Director and engineering leaders to turn security expectations into executed controls.

Compensation: USD 170,000 - 200,000 per year. Experience: 5+ years.

What you’ll do

• Execute day-to-day information security operations across corporate IT, platform, and product environments in partnership with the Global IT Director, who sets security policy and strategy.
• Maintain the existing ISO 27001:2022 certification by managing evidence collection, internal audits, and corrective actions, and supporting annual surveillance and recertification audits.
• Complete customer security due diligence including security questionnaires (SIG, CAIQ), support customer audits, and track contractual security requirements with coordination from Legal and Sales.
• Partner with Platform Engineering to build application security into the SDLC through threat modeling support, secure code review guidance, and operation of SAST/DAST/SCA tooling.
• Run vulnerability management for applications and platform infrastructure, including scanning, triage, and driving remediation with engineering teams to SLA.
• Coordinate third-party penetration tests and security assessments and track findings through closure.
• Partner with the Infrastructure Engineer on the security posture of network and compute infrastructure, including alignment between application/platform controls and network security architecture (including EDR/managed SOC and network IDS/IPS controls).
• Support security incident response by helping maintain the IR plan, participating in investigations, and running periodic tabletop exercises.
• Support identity and access governance for corporate and platform systems, including access reviews, certifications, and MFA/SSO enforcement with IT Engineering.
• Conduct security risk assessments for new vendors, tools, and third-party integrations.
• Maintain information security policies, standards, and employee security awareness training (including phishing simulations) in line with direction from the Global IT Director.
• Track and report on security posture, risk, and compliance status to the Global IT Director.
• Help evaluate and prepare for future compliance initiatives such as SOC 2 Type II, prioritized by leadership.

What you bring

• 5+ years of experience in security engineering, IT security, application security, or a closely related role.
• Experience maintaining an existing ISO 27001 ISMS, including evidence collection, internal audits, and support for surveillance/recertification audits (building from scratch is not required).
• Working knowledge of application security fundamentals (including OWASP Top 10 and secure SDLC practices) plus hands-on use of SAST/DAST/SCA tooling such as Snyk, Semgrep, Checkmarx, or Burp Suite.
• Proficiency in a scripting language (for example Python) for security automation, with strong interest in infrastructure-as-code (for example Terraform, Ansible) to codify and enforce security controls.
• Familiarity with GRC platforms for compliance evidence and monitoring.
• Basic cloud security literacy for AWS, Azure, and/or GCP, including IAM, network security groups, encryption, and logging/monitoring.
• Comfort completing customer security questionnaires and supporting customer-facing security conversations under direction.
• Familiarity with EDR/managed SOC platforms and comfort participating in security operations and detection/response workflows.
• Excellent written and verbal English communication skills for clear collaboration with IT, Platform Engineering, Software Development, and Delivery stakeholders.
• Comfort working as an execution-focused security practitioner in a lean IT organization, partnering closely with the Global IT Director, Infrastructure Engineer, Platform Engineering, and staff IT Engineers.

Technologies

ISO 27001:2022, ISO 27001, OWASP Top 10, SAST, DAST, SCA, Snyk, Semgrep, Checkmarx, Burp Suite, Python, Terraform, Ansible, GRC platforms, AWS, Azure, GCP, EDR, managed SOC, network IDS/IPS, SOC 2 Type II, SIG, CAIQ, MFA/SSO

It would be great if you also have

• Security certifications such as Security+, GSEC, or CCSP.
• Experience in manufacturing, industrial, IoT, or OT/ICS security environments.
• Exposure to penetration testing engagements, hands-on or coordinating with external testers.
• Familiarity with Zero Trust architecture principles.
• English language proficiency.