SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
CommerceIQ is building an AI platform that powers commerce for the world's largest brands, shipping AI agents for content, media, and sales into Fortune 100 workflows. The company serves 2,200+ customers including Coca-Cola, Nestlé, Colgate-Palmolive, Mondelez, Samsung, and Kellogg's, with 10 of the top 12 CPG companies as clients. Backed by SoftBank, Insight Partners, and Madrona, CommerceIQ is pre-IPO with teams across the US, India, Canada, and the UK.
You will join as a hands-on Security Engineer III, working closely with Engineering, DevOps, and IT teams to strengthen cloud, application, and infrastructure security as the company scales.
Key responsibilities include:
• Securing AWS and GCP environments (IAM, network security, encryption, logging, access controls)
• Performing application security reviews, vulnerability assessments, and penetration testing coordination
• Integrating security scanning into CI/CD pipelines (SAST, DAST, dependency scanning, container scanning, IaC scanning)
• Securing Kubernetes, Docker, Terraform, and Linux systems
• Improving threat detection, security logging, alerting, and incident response processes
• Identifying, prioritizing, and remediating vulnerabilities across applications and infrastructure
• Supporting SOC 2, ISO 27001, and customer security assessments
• Building automation scripts and tools for security checks and reporting
• Investigating security incidents and implementing preventive measures
• Collaborating cross-functionally to embed security into engineering workflows
Requirements:
• 6–10 years of experience in information security, cloud security, application security, or DevSecOps
• Strong hands-on experience with AWS and/or GCP security
• Understanding of IAM, least-privilege access, secrets management, encryption, and network security
• Experience integrating security tools into CI/CD pipelines
• Familiarity with tools such as SonarQube, Snyk, Trivy, Checkov, Wiz, or equivalent
• Working knowledge of Kubernetes, Docker, Terraform, GitHub Actions, Jenkins, or similar technologies
• Knowledge of OWASP Top 10, common application vulnerabilities, and secure coding practices
• Experience with vulnerability management, security incident response, and risk assessment
• Scripting skills in Python, Bash, or similar languages
• Understanding of SOC 2 or ISO 27001 requirements
