Apply on Employer Site

Pliant · 2 months ago

Security Engineer remote (m/f/d)

United States

Full-time

Remote

Senior Level

5+ years exp

Pliant is a European fintech specializing in B2B payment solutions, seeking a hands-on Security Engineer with expertise in DevSecOps and cloud security. The role involves integrating security best practices, designing security automation tooling, and collaborating with various teams to enhance security within their platform and workflows.

Credit CardsFinanceFinancial ServicesFinTech

Growth Opportunities

Responsibilities

Integrate security best practices throughout the SDLC to protect products, infrastructure, and customer data

Design, implement, and maintain security automation tooling to address problems at scale (e.g., patch management, vulnerability management, compliance evidence collection)

Embed security controls and guardrails into the developer platform to enable secure and efficient delivery

Define and promote 'Paved Roads' - reusable, secure development standards and Terraform/Docker modules

Harden containerized workloads (ECS and EKS) - ensure clusters follow security best practices for isolation, networking, and access control; Maintain secure, up-to-date base images; enforce image signing and provenance; implement admission control, least-privilege IAM roles, and runtime anomaly detection

Deploy and manage cloud security platforms (e.g., Wiz) and drive remediation workflows

Automate collection of audit-ready evidence for frameworks like PCI DSS, ISO 27001, SOC 2, and DORA

Support vulnerability management (triage, SLAs, RCA) and lead incident response and post-mortems

Conduct threat modeling, architecture reviews, and provide guidance on secure design and cryptography

Build and maintain security documentation, internal tooling, and feedback loops to strengthen security culture

Act as a security SME across application, cloud, and compliance domains

Qualification

DevSecOpsAWS securityTerraformContainer securityVulnerability managementPythonBashTypeScriptOWASP Top 10EmpathyCommunicationCollaboration

Required

5+ years of experience in a technical security role, preferably in a cloud-native or fintech/SaaS environment

Strong proficiency with AWS services and security (IAM, KMS, CloudTrail, S3, GuardDuty, SCPs, etc.)

Solid understanding of DevSecOps practices and integrating security into CI/CD workflows

Proficient in Terraform and other IaC tooling, capable of writing secure, reusable modules and enforcing guardrails

Proficient in Python, Bash, or TypeScript – capable of scripting and building automation tools

Experience securing containers (Docker, ECS, EKS, or Kubernetes) and implementing hardened images

Expert level understanding of OWASP Top 10, secure coding, and software supply chain risks

Experience managing and integrating cloud security platforms (e.g., Wiz, Orca, Lacework, Prisma Cloud)

Understanding of vulnerability management and remediation workflows at scale

Experience with application security practices, including code review, threat modeling, static and dynamic analysis (SAST, DAST), and attack surface analysis

Experience performing Application Penetration Testing or Vulnerability Research / Bug Bounty Hunting. (Ability to discover and identify fixes for SQLi, XSS, CSRF, SSRF, authentication and authorization flaws, and other web-based security vulnerabilities)

Experience with threat modeling or security reviews

Excellent communication skills and empathy, security is a complex topic that you have to be able to explain to audiences of various levels of previous exposure or learning