Information Security Engineer

Overview

Information Security Engineer focused on SaaS & integration security, including securing internal SaaS apps, third-party integrations, APIs, and automation workflows.

What you'll do

• Own the end-to-end security review process for new SaaS applications and integrations.
• Build threat modeling and secure design practices across the integration lifecycle.
• Contribute to incident response for SaaS and identity-related events.
• Set and maintain security standards for SaaS apps, integrations, APIs, plugins, and automation platforms.
• Assess OAuth scopes, tokens, service accounts, webhooks, extensions, and marketplace apps for permission and access risks.
• Conduct vendor and third-party security assessments and reassess risk over time.

What you'll need

• 3+ years in SaaS security, application security, cloud security, or related defensive security.
• Experience conducting technical security reviews and risk-based threat modeling.
• Track record assessing third-party integrations, APIs, and vendor risk before adoption.
• Experience validating security findings and driving remediation with engineering/business teams.
• Solid grasp of least privilege, defense in depth, and trust boundary analysis.
• Familiarity with identity concepts including OAuth, SAML, OIDC, SSO, and MFA.
• Ability to read and review scripts in Python, JavaScript, or shell for security weaknesses.