[Remote] Sr. Security Engineer
Note: The job is a remote job and is open to candidates in USA. Procurement Sciences is a venture-backed SaaS company transforming government contracting with its Awarded AI platform. The Sr. Security Engineer will own the engineering side of the security program across vulnerability management, application security, AI/LLM security, cloud hardening, detection, automation, incident response, and compliance.
Responsibilities
- Vulnerability management end to end, including pen tests, CSPM/CWPP tooling (Wiz), MTTR, and risk reporting for leadership and customers
- Application security: SAST, DAST, SCA, secret scanning, threat modeling, secure code review, and developer training. You're the person engineers come to with security questions
- AI/LLM security across our model integrations, RAG pipelines, and LLM provider APIs (Anthropic, Google Vertex AI, OpenAI). Prompt injection, data exfiltration, model abuse, output guardrails, and evaluating new AI features before they ship
- Cloud and infrastructure security in Azure/AKS and GCP under FedRAMP and GCC High requirements: IAM, network segmentation, encryption, Kubernetes runtime protection, IaC scanning, WAF, and zero-trust design with the DevOps team
- Security automation: CI/CD security gates, detection-as-code, SOAR, custom tooling, and automated compliance evidence collection for SOC 2, FedRAMP, and CMMC
- Detection and response across endpoints (SentinelOne), cloud, and application layers. Lead or support incident response and keep the IR plan current
- Compliance and customer trust: technical controls mapped to NIST 800-53, SSPs and POA&Ms, continuous monitoring, and clear technical answers to customer security assessments
Skills
- 5+ years of hands-on security engineering with depth in at least three of: vulnerability management, AppSec, cloud security, security automation, detection engineering
- Strong cloud-native security experience (Azure and/or GCP preferred), including Kubernetes, container hardening, and IaC security
- Proven experience operating vulnerability scanners, SAST/DAST/SCA, CSPM/CWPP, EDR, SIEM, and secret scanning
- Enough Python, Go, TypeScript, or Bash to build automation and custom tooling
- Clear communication with developers and customers alike
- US citizenship (required for FedRAMP and defense customers)
- Experience securing AI/ML systems and LLM applications (OWASP Top 10 for LLM, MITRE ATLAS)
- SaaS security background at a B2B or GovTech company
- Working knowledge of FedRAMP, CMMC, NIST 800-53, NIST 800-171, and SOC 2, and how technical controls map to them
- FedRAMP or CMMC assessment support from the engineering side
- GCC High, Azure Government, or AWS GovCloud experience
- Familiarity with DFARS 252.204-7012, CUI handling, and ITAR/EAR
- Certifications such as OSCP, GIAC, cloud security certs, or CISSP
- Prior founding or early security hire at a startup
Benefits
- Performance-based incentive plan
- Stock options in a rapidly growing, venture-backed company
- Comprehensive health plan for employees and their loved ones
- Flexible work arrangements, including full remote work capabilities
- Extensive professional development opportunities and a fast track for career advancement
Company Overview