Security Engineer

Your Role: Security Engineer

We're looking for an experienced, hands-on Security Engineer to secure XBOW's product, cloud, and platform as we scale. This is a technical individual contributor role focused on building security into how we design, ship, and operate systems.

You'll work closely with engineering and platform teams across application security, cloud security, vulnerability management, and incident response. The core of this role is security engineering ownership: improving preventive controls, detection quality, and response readiness, while driving remediation of real risks in production.

What You'll Do:

• Design and implement security controls across cloud, infrastructure, and internal platforms

• Partner with engineering to harden cloud architecture, IAM, and infrastructure

• Own product security reviews for new features, services, and major architecture changes

• Drive threat modeling and secure design decisions early in the SDLC

• Operate and improve AppSec workflows (SAST, SCA, secrets scanning, IaC scanning)

• Triage vulnerabilities across application, container, and cloud findings, and drive remediation with risk-based SLAs

• Define and run the vulnerability management lifecycle: intake, prioritization, exception handling, validation, and reporting

• Improve CNAPP coverage and finding quality across cloud accounts and workloads

• Improve Kubernetes and container security posture

• Monitor, investigate, and respond to security events and incidents

• Build automation to improve security operations, access workflows, and incident response

• Support the wider teams by providing timezone coverage for our fully remote organization.

Who You Are:

Essential-

• 5+ years of experience in security engineering, product security, cloud/platform security, or closely related roles

• Strong hands-on experience securing cloud environments (AWS, Azure and GCP)

• Comfortable owning technical security problems end-to-end in fast-moving environments

• Hands-on experience with product/application security in engineering environments (secure design reviews, threat modeling, code-level risk discussions)