Security Engineer

ExpanseFT is a payment-processing company with a cloud-native platform and responsibilities under the Payment Card Industry Data Security Standard (PCI DSS). We run a hybrid environment spanning multiple cloud providers and an on-premises data center, and we operate a mature security program with an active incident-response capability, formal change control, and annual third-party assessment.

We're a small, senior, engineering-first team — you'll have significant scope and ownership from day one.

We're hiring our first dedicated Security Engineer. You'll report to the EVP, Platform & Technology (who currently covers this function) and you'll become the primary operator of our day-to-day security program.

Translation: this is a hands-on, queue-owning role, not a policy-writing or architecture-only role. You'll investigate alerts, tune detections, run vulnerability cycles, coordinate audits, execute access reviews, and own the evidence trail that keeps our compliance program defensible.

• Own the daily security operations queue — triage and investigate alerts and findings across our cloud SIEM, XDR, EDR, and cloud-security-posture tooling. Drive each to closure with documented evidence.
• Operate the vulnerability management lifecycle — quarterly external scans (ASV), internal authenticated scans, container and Lambda scanning, dependency alerts, and penetration-test follow-through. Track remediation against SLA.
• Administer endpoint protection across our endpoint fleet — agent deployment, policy tuning, detection quality, and threat response.
• Run the access-review program — periodic user, privileged, service-account, and third-party access reviews across our identity providers; terminated-user revocation verification; provisioning and deprovisioning execution.
• Lead incident response as the primary responder for security events — containment, forensics, communications, and post-incident review — with executive escalation where warranted.
• Own the PCI DSS evidence program — collect, label, and retain audit evidence for our annual QSA assessment. Be the QSA's primary operational point-of-contact during fieldwork.
• Contribute to detection engineering — write and tune SIEM analytics rules, improve signal-to-noise on high-volume detections, and propose automation improvements.
• Participate in on-call support for security alerts, including out-of-hours escalation.
• Deliver annual security-awareness training and support the quarterly personnel review process.
• Support physical security at our data center facility (visitor logs, device inspections, media destruction, rogue-wireless detection) on a periodic on-site basis.

You will operate a full, modern hybrid security stack. Without naming specific vendor SKUs in this post:

• Two major cloud platforms (AWS and Azure), multi-account and multi-subscription, with central logging and security-services aggregation
• Cloud SIEM and XDR, with a large analytics-rule catalog and KQL as the primary query language
• Endpoint Detection & Response (EDR) across the fleet; integration with the SIEM
• Cloud-native security services for threat detection, vulnerability management, and compliance posture
• Automated patch-management across Windows servers, cloud workloads, and container images
• An enterprise identity stack with conditional access, governance access reviews, and PIM
• Ticketing and evidence workflow built on Jira Cloud, with custom automation for recurring compliance tasks and bidirectional integrations with the security stack
• On-prem perimeter and segmentation with a next-gen firewall and segmented VLANs

You don't need hands-on experience with every single product — you do need to have operated a comparable stack at a comparable scale in a regulated environment.

• 4+ years in Security Operations (L2/L3), Security Engineering, or a closely related role, in a regulated environment (payments, finance, healthcare, or equivalent)
• Hands-on experience operating AWS security services (e.g., Security Hub, GuardDuty, Inspector, IAM) in a multi-account setup
• Hands-on experience with a cloud SIEM, including KQL (Kusto Query Language) or equivalent query fluency; comfortable writing and tuning analytics rules, not just consuming them
• Experience administering an EDR platform (SentinelOne, Defender for Endpoint, CrowdStrike, or equivalent)
• Demonstrable experience running a vulnerability management lifecycle under SLA — scan, triage, evidence, remediation tracking
• Working knowledge of PCI DSS v4.0 (requirements 5, 7, 8, 9, 10, 11, and 12 in particular), or substantively equivalent experience with SOC 2, ISO 27001, HITRUST, or NIST CSF
• Proficient in at least one scripting language for operations automation — Python, Bash, or PowerShell — plus comfort with jq, AWS CLI, and az CLI
• Strong written communication — you will be the voice of security in tickets, runbooks, and audit evidence a QSA reads a year later
• Able to work the queue independently, prioritize under SLA pressure, and escalate proactively

• One or more: CISSP, GIAC (GCIH, GCED, GMON, GCDA, GSEC), AWS Security Specialty, Azure Security Engineer Associate (AZ-500), CompTIA CySA+
• Prior role as the evidence point-of-contact on a PCI DSS QSA engagement
• Experience with open-source cloud security assessment tooling (e.g., Prowler, Steampipe, CloudQuery, cfn-nag, checkov, tfsec, trivy)
• Experience reading or contributing to AWS CDK (TypeScript) or Terraform
• Experience with a next-gen firewall platform (Cisco FTD/FMC, Palo Alto, Fortinet, or equivalent)
• Experience on a formal on-call rotation (PagerDuty, Opsgenie, or equivalent)

• First 90 days: You own the daily and weekly security-operations queue independently, with evidence attached to every closed ticket. You've shadowed a full monthly cycle and proposed at least one improvement.
• First 6 months: You've executed a full quarterly cycle, led at least one incident-response tabletop, and become the primary operational voice of security in our engineering org.
• First year: You've run a complete annual cycle (external pentest coordination, policy review, risk assessment, training refresh) and been a named evidence owner in our annual external audit.

• Base salary: [Range to be added before posting — mid-to-senior security-engineering market]
• On-call: Participation in the security on-call rotation (differential TBD)
• Training and certification budget — annual allocation for at least one major security certification plus a security conference each year
• Location and schedule — Remote but NY based. As-needed on-site visits to our data center on Long Island— either for scheduled physical-security duties (device inspections, visitor-log audits, media destruction oversight) or to respond to a security incident. These visits are event-driven, not a weekly or monthly commute.
• Benefits — per ExpanseFT standard package