Security Engineer

Firmable 's product depends on customer trust in how we handle their data. This role is the operational backbone of that trust: the controls you run are what let 1,000+ customers rely on Firmable with their data.

The Role As our Security Engineer , you'll own the day-to-day execution of the security controls and policies that keep Firmable compliant against SOC 2 (all five TSC) and ISO 27001:2022. You'll report into the Security & Compliance team, fully remote and open globally.

This is a hands-on operational role, not a paper-compliance one: you implement, monitor and continuously tighten the controls auditors and customers actually test against. ~90% hands-on execution: control implementation, continuous monitoring, evidence collection, vulnerability and access management.

~10% cross-functional: partnering with engineering on secure cloud config and shaping the program as it scales across frameworks.

What You'll Own SOC 2 & ISO 27001 execution: implement and maintain controls across infrastructure, applications and internal systems; close gaps as they're identified Security policy enforcement: put information security policy into daily practice across engineering and business teams, covering access control, data classification, incident response, vendor risk and change management Continuous control monitoring: recurring access reviews, log reviews, vulnerability scans and patch cadence checks; organise evidence ahead of audits Vulnerability management: triage scanner findings, coordinate remediation with engineering, verify closure Identity & access management: onboarding/offboarding, least-privilege and MFA enforcement, periodic access recertification Monitoring & incident response: watch security alerts and logs, triage and escalate per the incident response plan Risk & vendor management: maintain the risk register and third-party risk assessments, track remediation to closure Audit readiness: prepare evidence for annual assessments and respond to customer secur