Software Development

Senior Security Engineer

New York, NYOnsiteFull TimeSeniorPosted 7 days ago

Is this role right for you?

Upload your resume and get a skill-by-skill breakdown — see exactly where you match, where you're close, and what to highlight. Not a mystery percentage.

Get a tailored resume highlighting what this role needs.

Required skills

security engineering
application security
cloud security
AWS
web application security
mobile application security
OWASP Top 10
Rust
Python
Go

Nice to have

production Rust
React
React Native
e-commerce security
payments security
fraud prevention

Role summary

IcyBox is seeking a Senior Security Engineer to join their New York City office. This role is responsible for protecting the company, its customers, and their data by owning security across applications, cloud infrastructure, and internal systems. The engineer will identify and fix vulnerabilities, secure the AWS environment, conduct threat modeling, integrate security into CI/CD pipelines, lead incident response, and support compliance efforts. The position requires 5+ years of experience in security engineering, application security, or cloud security, with hands-on AWS experience and a strong understanding of web and mobile application security. Proficiency in at least one coding language and experience leading incident response are essential.

Our Mission

Everyone knows the feeling of opening something unexpected and loving it. IcyBox turns that feeling into a business. We started as a watch commerce and mystery box company and are building a consumer brand people trust and come back to. We move fast, sweat the details, and are still writing our playbook.

Our Values

Move Fast, Build Right: Ship today, fix tomorrow.
Own the Gap: If nobody owns it, we step in.
Clarity Is a Gift: Turn noise into decisions and action.
Trust Over Title: Follow-through beats position.
Say the Real Thing: Hard conversations happen early.
Do the Unglamorous Work: No task is beneath us.

About the Role

We’re hiring a Senior Security Engineer to protect IcyBox, our customers and their data. You’ll own security across our apps, cloud infrastructure and internal systems, and help the team build securely without slowing down. This role is in person at our New York City office, five days a week.

What You’ll Do

Find and fix vulnerabilities across our mobile, web, and backend apps
Secure our AWS environment, including access management, networking and secrets
Run threat modeling and security reviews for new features
Build security checks into CI/CD, such as code scanning and dependency checks
Lead incident detection and response, including logging, alerting and playbooks
Follow security news and disseminate relevant information to the team
Prevent account takeover, bots and abuse on our site and app
Manage penetration tests, bug bounty reports and vendor security reviews
Support compliance work such as PCI DSS and privacy laws
Train engineers on secure coding

What We’re Looking For

5+ years in security engineering, application security or cloud security
Hands-on experience securing AWS environments
Strong understanding of web and mobile application security, including the OWASP Top 10
Able to read and write code in at least one language, such as Rust, Python, Go or TypeScript
Experience leading incident response
Able to explain risk clearly and give engineers practical fixes

Nice to Have

Experience working with production Rust, React, and React Native systems
E-commerce or payments security experience, including PCI DSS
Fraud, bot and account takeover prevention
SIEM tools and detection engineering
Certifications such as OSCP, CISSP or AWS Certified Security – Specialty
First security hire or early security team experience at a startup

Ready to apply?

You'll be redirected to Infinite Edge's application page.