Description review
Security Engineer
Firmable · India · back to the listing
HR standards
64/100
needs work
Title ↔ description
88/100
strong
Reads as
Security Engineer
100% confident
What this role officially is
ICT security administrator — ESCO, the EU occupation classification
ICT security administrators plan and carry out security measures to protect information and data from unauthorised access, deliberate attack, theft and corruption.
Also known as: network security administrator, system security administrator, ICT security administrators, IT security administrator
How others title the same work
Large employers
- Security Risk Management Specialist Canonical Ltd.
- Security Software Engineer Canonical Ltd.
- Senior Security Operations Engineer Canonical Ltd.
- Staff Security Operations Engineer Canonical Ltd.
- Ubuntu Security Engineer Canonical Ltd.
Startups
- Security Engineer (Bangalore, India) AiPrise
- Security & Trust Engineer Alex
- Elucid | Senior Security Engineer | Boston, MA | ONSITE (hybrid) | $130k–$170k Elucid
- Factory | Security Engineer | ONSITE, San Francisco, CA | Full-Time Factory
- Factory | Security Engineer | Onsite in San Francisco | Full-time Factory
What the listing never says
- 20 bullet points. Long requirement lists deter qualified candidates, who read them as hard gates. Scope clarity
- No pay range published. Candidates cannot tell whether applying is worth their time. Pay transparency
The listing, marked up
Nothing in the wording of this listing tripped a check. The scores above still judge how complete and coherent it is.
Firmable's product depends on customer trust in how we handle their data. This role is the operational backbone of that trust: the controls you run are what let 1,000+ customers rely on Firmable with their data.
The Role
As our Security Engineer, you'll own the day-to-day execution of the security controls and policies that keep Firmable compliant against SOC 2 (all five TSC) and ISO 27001:2022. You'll report into the Security & Compliance team, fully remote and open globally. This is a hands-on operational role, not a paper-compliance one: you implement, monitor and continuously tighten the controls auditors and customers actually test against.
~90% hands-on execution: control implementation, continuous monitoring, evidence collection, vulnerability and access management.
~10% cross-functional: partnering with engineering on secure cloud config and shaping the program as it scales across frameworks.
What You'll Own
• SOC 2 & ISO 27001 execution: implement and maintain controls across infrastructure, applications and internal systems; close gaps as they're identified
• Security policy enforcement: put information security policy into daily practice across engineering and business teams, covering access control, data classification, incident response, vendor risk and change management
• Continuous control monitoring: recurring access reviews, log reviews, vulnerability scans and patch cadence checks; organise evidence ahead of audits
• Vulnerability management: triage scanner findings, coordinate remediation with engineering, verify closure
• Identity & access management: onboarding/offboarding, least-privilege and MFA enforcement, periodic access recertification
• Monitoring & incident response: watch security alerts and logs, triage and escalate per the incident response plan
• Risk & vendor management: maintain the risk register and third-party risk assessments, track remediation to closure
• Audit readiness: prepare evidence for annual assessments and respond to customer security questionnaires
• Security awareness: run employee training and phishing simulations
• Secure cloud configuration: partner with engineering on least-privilege IAM, encryption at rest and in transit, and secrets management (AWS)
What We're Looking For
Must haves
• 2–5 years in security engineering, cloud security or infrastructure security, ideally with direct SOC 2 or ISO 27001 exposure
• Working knowledge of the SOC 2 Trust Services Criteria and how technical controls map to them
• Hands-on cloud security fundamentals (AWS preferred): IAM, logging/monitoring, vulnerability scanning
• Comfortable executing policy day to day (access reviews, evidence collection, remediation tracking), not just writing it
• Clear written communication and comfortable working async across time zones with a distributed team
Highly valued
• Familiarity with GRC automation platforms (Vanta, Drata or similar)
• Relevant certification (Security+, CySA+, ISO 27001 Lead Implementer, or progress toward CISA/CISSP)
The Environment
Fully remote, open globally, working closely with a distributed Security and Engineering team across time zones. Real ownership over controls that directly protect customer trust, not a box-ticking exercise. Fast-moving, AI-native product team.
Why This Role
• Real ownership: the controls you run directly protect the trust 1,000+ customers place in Firmable's data
• Multi-framework exposure from day one: a live SOC 2 and ISO 27001 program, not a single-framework box-tick
• Competitive compensation and flexible hours in a fast-moving, AI-native product team
Originally posted on Himalayas
The Role
As our Security Engineer, you'll own the day-to-day execution of the security controls and policies that keep Firmable compliant against SOC 2 (all five TSC) and ISO 27001:2022. You'll report into the Security & Compliance team, fully remote and open globally. This is a hands-on operational role, not a paper-compliance one: you implement, monitor and continuously tighten the controls auditors and customers actually test against.
~90% hands-on execution: control implementation, continuous monitoring, evidence collection, vulnerability and access management.
~10% cross-functional: partnering with engineering on secure cloud config and shaping the program as it scales across frameworks.
What You'll Own
• SOC 2 & ISO 27001 execution: implement and maintain controls across infrastructure, applications and internal systems; close gaps as they're identified
• Security policy enforcement: put information security policy into daily practice across engineering and business teams, covering access control, data classification, incident response, vendor risk and change management
• Continuous control monitoring: recurring access reviews, log reviews, vulnerability scans and patch cadence checks; organise evidence ahead of audits
• Vulnerability management: triage scanner findings, coordinate remediation with engineering, verify closure
• Identity & access management: onboarding/offboarding, least-privilege and MFA enforcement, periodic access recertification
• Monitoring & incident response: watch security alerts and logs, triage and escalate per the incident response plan
• Risk & vendor management: maintain the risk register and third-party risk assessments, track remediation to closure
• Audit readiness: prepare evidence for annual assessments and respond to customer security questionnaires
• Security awareness: run employee training and phishing simulations
• Secure cloud configuration: partner with engineering on least-privilege IAM, encryption at rest and in transit, and secrets management (AWS)
What We're Looking For
Must haves
• 2–5 years in security engineering, cloud security or infrastructure security, ideally with direct SOC 2 or ISO 27001 exposure
• Working knowledge of the SOC 2 Trust Services Criteria and how technical controls map to them
• Hands-on cloud security fundamentals (AWS preferred): IAM, logging/monitoring, vulnerability scanning
• Comfortable executing policy day to day (access reviews, evidence collection, remediation tracking), not just writing it
• Clear written communication and comfortable working async across time zones with a distributed team
Highly valued
• Familiarity with GRC automation platforms (Vanta, Drata or similar)
• Relevant certification (Security+, CySA+, ISO 27001 Lead Implementer, or progress toward CISA/CISSP)
The Environment
Fully remote, open globally, working closely with a distributed Security and Engineering team across time zones. Real ownership over controls that directly protect customer trust, not a box-ticking exercise. Fast-moving, AI-native product team.
Why This Role
• Real ownership: the controls you run directly protect the trust 1,000+ customers place in Firmable's data
• Multi-framework exposure from day one: a live SOC 2 and ISO 27001 program, not a single-framework box-tick
• Competitive compensation and flexible hours in a fast-moving, AI-native product team
Originally posted on Himalayas