Senior Security Engineer

• Using AI tools responsibly to accelerate research, analysis, documentation, and problem-solving
• Exercising strong judgment around data privacy, accuracy, and ethical use
• Continuously learning and adapting as AI capabilities evolve

What you will do

Find and prove

• Run AI-assisted scanning of our code, infrastructure, and cloud configuration, and triage the results into real, ranked findings
• Test our applications the way an attacker would, through pentesting and ethical hacking, with a focus on business logic flaws in checkout, account, and payment flows
• Run quarterly access reviews, and ensure that SSO and MFA stays consistent across the SaaS tools we manage
• Review our AWS, Kubernetes, and infrastructure-as-code setup for weaknesses in identity, encryption, secrets, and network controls, and hand clear, prioritized fixes to the owning teams
• Own our pentest and bug bounty work: scope it, triage what comes in, give each finding an owner and a severity-based deadline, and verify every fix
• Set our edge security policy as we modernize: WAF and bot management (letting search engines and approved AI crawlers through while blocking malicious bots), TLS, DNS, and certificates

Operate and respond

• Watch AWS security signals and our SIEM and EDR; keep endpoint coverage complete across servers, clusters, and devices; and lead the security side of incidents alongside our incident commander
• Get full value from the security tools we already have, starting with our SIEM: bring in the right data sources, build and tune detections, cut noise, and show leadership what each tool delivers
• Own code security day-to-day in GitHub and our code analysis tools: dependency alerts, code and secret scanning, quality gates on pull requests, branch protection, and repository access, with findings routed to the right teams
• Help design and run tabletop exercises with the infrastructure team, owning the security scenarios
• Coordinate our response when a widely exploited vulnerability hits (think Log4Shell), drive patching to completion, and document risk acceptance when we choose not to patch
• Keep our compliance work (SOC 2, ISO 27001, PCI DSS, security questionnaires, partner assessments, quarterly PCI ASV scans, and the Trust Center) on schedule, and use AI and a compliance platform to automate evidence collection and questionnaire drafting so it stays a small share of your time
• Keep our contractual security obligations visible and our security processes documented
• Define how engineers use AI safely: what data can and cannot go to AI tools, prompt-injection risks, and how to review AI-generated security suggestions
• Set best practices for handling PII and route them to the teams that own each system

Prevent

• Build guardrails so issues do not come back: policy-as-code, organization-level controls, and security checks in CI/CD and GitHub
• Mature detection and incident readiness, including runbooks and response playbooks
• Defend against AI-accelerated attacks: shorten the time from a disclosed vulnerability to a verified fix, harden identity and email against AI-written phishing and impersonation, detect automated credential and bot abuse, and help shape the roadmap for where we invest next
• Evaluate security tools from the major vendors and automate recurring scans, ticket creation, and reporting

What success looks like

• You know our environment end to end and have a risk-ranked plan the team agrees on
• AI-assisted scanning runs on a regular schedule and produces triaged findings, not raw noise
• Every open security finding has an owner, a severity, and a due date

• Vulnerabilities are fixed within severity-based timelines, internet-facing critical issues first, and exceptions are documented as risk acceptances; the time from a public exploit to our fix keeps shrinking as attackers get faster
• Security controls live in code, and guardrails catch misconfigurations before they reach production, so fewer new findings appear each quarter
• Our security tools earn their cost: the right data flows into the SIEM, detections are tuned, and time to detect and respond keeps improving
• Audits, scans, partner assessments, and questionnaires are completed on time with evidence ready, not in a scramble
• Incident runbooks are tested in tabletop exercises and improved after every incident
• Leadership gets a regular, plain-language view of security risk and trends, and application teams bring security questions to you early
• The CloudSecOps team and engineering teams handle more security work on their own, because you have helped them learn how

What you bring

• 5+ years in cloud, infrastructure, application, or security engineering, with recent years focused on security
• Strong working knowledge of cloud infrastructure, especially AWS: IAM, encryption, logging, network controls, and native security services, enough to find flaws and guide the fix
• Able to read infrastructure as code (Terraform) and spot security misconfigurations, and comfortable scripting in Python, Bash, or similar to automate scans, detections, and reporting
• A track record of driving security remediation: pentest and scan findings, patching, and widely exploited vulnerabilities, driven to verified closure across teams
• Experience in SOC 2, ISO 27001, or PCI DSS environments at an eCommerce company or a high-traffic SaaS platform: access reviews, audit evidence, questionnaires, and third-party assessments, including working with auditors
• Experience with vulnerability management and incident response
• Application security testing experience (pentesting or ethical hacking), especially business logic flaws in web apps; strongly preferred
• Hands-on use of AI in security work, such as AI-assisted scanning, triage, or code review, with a clear view of how to use AI safely
• Security certifications such as CISSP, CISM, Security+, or equivalent strongly preferred
• Excellent written communication skills; comfortable writing clear, accurate responses for customer-facing security documentation
• Hands-on experience running a SIEM and EDR: building and tuning detections, investigating alerts, and leading incident response
• Strong follow-through, clear writing, and a habit of teaching: you work independently, help others grow, use AI tools daily, and learn and unlearn quickly, letting go of tools and habits that AI or new threats have made obsolete

Nice to have

• EDR, WAF, and bot management platforms
• Kubernetes (EKS) and container security
• Building preventive guardrails: policy-as-code, AWS organization controls, and security checks in CI
• Secrets management with HashiCorp Vault or similar, and Zero Trust remote access
• A compliance automation platform such as Vanta, Drata, or Delve, plus GitHub security features and static analysis tools
• Writing Terraform
• Working with AI to build in house security tooling to assist in the awareness and remediation of security vulnerabilities
• Security certifications (AWS Security Specialty, Security+, CISSP, or similar)

Why RevolutionParts

• Autonomy: you decide how we find our weaknesses and how we prevent them
• Build the function: help turn CloudOps into CloudSecOps and shape how security works here
• AI tooling: we are AI-first, and you will have room to build how we use AI to find and prevent security problems
• Real impact: your work protects a high-traffic eCommerce platform that automotive businesses and their customers rely on every day
• Mentor and grow others: raise the security skills of the engineers you work with
• A real bias for action: we make decisions quickly and ship; good ideas do not wait months for approval