Software Engineer, Security Focus

We are looking for a hands-on full-stack Software Engineer who will focus primarily on security remediation. Your first priority will be owning the remediation of vulnerabilities identified through penetration testing: not just reporting findings, but digging into the codebase, session traffic, and infrastructure to fix the underlying issues and prevent them from recurring. You will work closely with engineering and design teams to translate real-world security findings into concrete, testable requirements in our Technical Requirements Documents (TRDs), and you will personally implement or oversee the fixes.

This is an engineering role first. As the security backlog comes under control, you will have the flexibility to contribute to application development across our Ruby on Rails and React platform, bringing a security-minded perspective to the features you build.

Key Responsibilities

Security Remediation

• Vulnerability Remediation: Own end-to-end remediation of vulnerabilities surfaced by penetration tests and other security assessments, from triage through verified fix.
• Traffic and Session Analysis: Use browser-based code inspection tools to examine session traffic between the front end and back end, identify cases where excessive or sensitive information is being exposed, and translate those findings into concrete design and engineering requirements.
• TRD Input: Feed vulnerability findings and remediation requirements directly into the Technical Requirements Document (TRD) process so fixes are captured as durable design requirements, not one-off patches.
• Session Management: Review and harden session management practices across the application stack.
• Full-Stack Remediation: Work within a Ruby on Rails and React codebase and across containerized services (AWS, Fargate) to implement fixes at both the application and infrastructure layers.
• API and Real-Time Systems: Assess and secure real-time and API-driven features, including those built on Pusher and AnyCable, and RESTful APIs generally.
• Documentation: Produce clear, thorough documentation of vulnerabilities, root causes, remediation steps, and verification results.
• Compliance Support: Contribute security context and vocabulary to FedRAMP-related discussions and requirements, partnering with compliance and engineering stakeholders.

Application Development

• Feature Development: Design, build, and ship features across the Ruby on Rails back end and React front end alongside the broader engineering team.
• Secure by Design: Apply what you learn from remediation work to new development, helping the team avoid reintroducing known classes of vulnerabilities.
• Code Quality: Participate in code reviews, testing, and technical design discussions, with an eye toward both security and maintainability.