Invoca

Staff Information Security Engineer

Invoca

full-time

Posted on:

Origin:  • 🇺🇸 United States

Visit company website
✨ AI Apply
Manual Apply

Salary

💰 $152,000 - $228,000 per year

Job Level

Lead

Tech Stack

AWSCloudDockerGoogle Cloud PlatformKubernetesPythonSDLCTerraform

About the role

  • Architect and secure the infrastructure and applications that power Invoca’s SaaS platform, ensuring robustness, scalability, and resilience.
  • Embed security throughout the SDLC, driving secure architecture, coding, and deployment practices and adoption of scalable, testable, observable security controls.
  • Guide teams through identifying, evaluating, and solving risk-based, high-impact security challenges; break down large initiatives into achievable outcomes.
  • Take ownership of department-level projects, prioritize security work, and deliver solutions balancing risk reduction with business value.
  • Mentor and coach other engineers; share security engineering expertise and grow the next generation of security leaders.
  • Contribute to incident response, vulnerability management, and defensive strategies to detect, respond to, and learn from security events.
  • Report to the Manager of Security and collaborate cross-functionally with product and engineering teams.

Requirements

  • 6+ years of experience in security engineering or a related software engineering discipline.
  • At least 2+ years leading large-scale security initiatives or cross-functional projects.
  • Expertise in core security principles, vulnerability management, automation, and defensive security strategies.
  • Deep experience with cloud-native platforms (at least AWS or GCP), including IAM, networking, encryption, and monitoring.
  • Familiarity with securing Terraform, CloudFormation, or similar IaC workflows.
  • Proficiency with securing Docker and Kubernetes environments.
  • Strong knowledge of secure coding practices, SAST/DAST tools, dependency management, and threat modeling.
  • Hands-on experience with SSO, MFA, secrets management, and federated identity providers.
  • Experience with SIEM, EDR/XDR, logging pipelines, and threat detection frameworks.
  • Expertise in identifying, prioritizing, and remediating vulnerabilities across infrastructure, applications, and third-party dependencies.
  • Fluency in a programming/scripting language (e.g., Python or similar) to automate security workflows.
  • Hands-on experience with monitoring/alerting tools and structured incident response processes.
  • Exposure to DLP, encryption, tokenization, or voice/data privacy protections.
  • Ability to integrate AI/ML observability into security monitoring and detect anomalies or misuse of generative AI systems.
  • Experience supporting compliance with frameworks like SOC 2, ISO 27001, or PCI DSS is a plus.
  • Strong collaboration and communication skills; ability to influence technical strategy and mentor engineers.
  • Must be located in the United States or Canada; unable to provide visa sponsorship for this position.