SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Bright Machines, an AI-enabled manufacturer of data center infrastructure, is seeking a Security Engineer to execute and enforce the company's day-to-day information security program across corporate, product, and manufacturing environments. You will report to the Global IT Director and partner closely with Infrastructure Engineering and Platform Engineering teams.
Key responsibilities include:
• Execute day-to-day information security operations across corporate IT, platform, and product environments in partnership with the Global IT Director.
• Maintain ISO 27001:2022 certification through evidence collection, internal audits, corrective actions, and support for annual surveillance and recertification audits.
• Execute customer security due diligence, completing security questionnaires (SIG, CAIQ), supporting customer audits, and tracking contractual security requirements in partnership with Legal and Sales.
• Partner with Platform Engineering to build application security into the SDLC, including threat modeling support, secure code review guidance, and operation of SAST/DAST/SCA tooling.
• Run vulnerability management across applications and platform infrastructure: scanning, triage, and driving remediation with engineering teams to SLA.
• Coordinate third-party penetration tests and security assessments; track findings to closure.
• Partner with the Infrastructure Engineer on security posture of network and compute infrastructure, including EDR/managed SOC and network IDS/IPS controls.
• Support security incident response: maintain the IR plan, participate in investigations, and run periodic tabletop exercises.
• Support identity and access governance for corporate and platform systems (access reviews, certifications, MFA/SSO enforcement) with IT Engineering.
• Conduct security risk assessments for new vendors, tools, and third-party integrations.
• Maintain information security policies, standards, and employee security awareness training (including phishing simulations).
• Track and report on security posture, risk, and compliance status to the Global IT Director.
• Help evaluate and prepare for future compliance initiatives (e.g., SOC 2 Type II) as prioritized by leadership.
You will work in a lean IT organization, partnering closely with the Global IT Director, Infrastructure Engineer, Platform Engineering, and staff IT Engineers. Strong written and verbal English communication is essential.
REQUIREMENTS:
• 5+ years of experience in security engineering, IT security, application security, or a closely related role.
• Experience maintaining an existing ISO 27001 ISMS: evidence collection, internal audits, and support for surveillance/recertification audits. (Building an ISMS from scratch is not required.)
• Working knowledge of application security fundamentals (OWASP Top 10, secure SDLC practices) with hands-on experience using SAST/DAST/SCA tooling (e.g., Snyk, Semgrep, Checkmarx, Burp Suite).
• Proficiency in a scripting language (e.g., Python) for security automation, with a strong inclination toward infrastructure-as-code (e.g., Terraform, Ansible) for codifying and enforcing security controls.
• Familiarity with GRC platforms for compliance evidence and monitoring.
• Basic cloud security literacy (AWS, Azure, and/or GCP): IAM, network security groups, encryption, logging and monitoring.
• Comfortable completing customer security questionnaires and supporting customer-facing security conversations under direction.
• Familiarity with EDR/managed SOC platforms and comfort participating in security operations and detection/response workflows.
• Excellent written and verbal English communication skills.
• Comfortable as an execution-focused security practitioner in a lean IT organization.
NICE-TO-HAVE:
• Security certifications such as Security+, GSEC, or CCSP.
• Experience in manufacturing, industrial, IoT, or OT/ICS security environments.
• Exposure to penetration testing engagements, hands-on or coordinating with external testers.
• Familiarity with Zero Trust architecture principles.
