Permanent WFH: Security Developer - Full Stack
Search Jobs
Search by job, company or skills
Search by job, company or skills
Permanent WFH: Security Developer - Full Stack
Full-time · Remote
Level/Seniority: Senior Engineer (5–10 years)
Permanent Work From Home
OPEN TO ALL APPLICANTS NATIONWIDE!
Company Provided Machine
Candidate must have a stable internet not lower than 50mbps.
ABOUT THE ROLE
Security Platform Engineering is responsible for designing and building the core security platform that powers Security Platform This team develops the custom tooling, automation, and integrations that transform raw security data into actionable intelligence — connecting the detection engine, alert pipeline, incident management, and analyst workflows into a unified operational platform. This position drives the hands-on engineering and full-stack execution of the security platform. You will build the critical software components that power the detection and correlation engine, alert routing, SIGMA rule pipelines, IOC enrichment, and the analyst-facing interfaces that SOC teams depend on daily. You will work closely with the Sensor Engineering team, AI/LLM team, and the Operations team (DFIR, threat hunters, red team) to ensure the platform reflects how elite security teams actually operate.
WHAT YOU WILL WORK ON
You will own three tightly connected areas: the security platform itself, detection engineering, and the full-stack automation that powers it at scale.
• Build and maintain the core security platform — detection engine, alert management, incident management, and rule management pipeline.
• Integrate security controls into our Kubernetes-native infrastructure and maintain the MCP Server tool integrations used by the AI/LLM layer.
• Write security automation in Python and/or Go — REST APIs for the Vue.js frontend, high-availability backend services, and responsive SPA components.
• Build and improve the correlation engine — event clustering, severity scoring, IOC enrichment, and blast radius assessment.
• Develop APIs and integrations across the security stack — SIEM, SOAR, EDR, IDS/IPS, container security, and threat intelligence feeds.
• Automate incident response workflows and optimize multi-source log pipelines for real-time security monitoring.
• Package and deploy security microservices in Kubernetes with hardened configurations, SSL/TLS, and secure authentication.
• Keep security architecture docs, detection playbooks, and automation runbooks up to date so the Operations team can work independently.
• Lead by example on secure coding — OWASP, SSDLC, peer code reviews, and enforcing hardened configurations across all services.
REQUIREMENTS
Core — All Required
• 8–10 years of hands-on full-stack engineering, with a proven track record building production security platforms or security tooling.
• Strong Python and/or Go — microservices, REST API design, and security automation at scale.
• Frontend proficiency in Vue.js — building complex, real-time SPAs with live data feeds and security-focused UX.
• Production experience with OpenSearch, PostgreSQL, and Redis — high-throughput data pipelines, index design, and alerting configuration.
• Familiarity with detection engineering concepts — SIGMA rules, MITRE ATT&CK framework, IOC/TTP correlation, and how SIEM alerting pipelines are structured — enough to build the right tooling for detection engineers to work in.
• Hands-on experience integrating and processing telemetry from network and security sensors — Suricata, Zeek, NeuVector, or similar (file analysis, honeypots, or WAF experience a plus).
• Proven Kubernetes microservice deployment and operations in production environments (Rancher/RKE2 a strong plus).
• Solid grasp of SSDLC, OWASP, data encryption, and end-to-end SSL/TLS — applied, not just theoretical.
Strong Advantage — Not All Required
• Prior experience building products or tooling for SOC, SIEM, SOAR, NSM, or detection engineering environments.
• Familiarity with the MITRE ATT&CK framework, TTP mapping, and IOC enrichment pipelines (OTX, MISP, OpenCTI / STIX 2.1).
• Experience integrating with container security platforms such as NeuVector — network policies, DLP events, vulnerability scanning.
• Practical experience building MCP server integrations or working with LLM tool-calling pipelines (LangGraph, function calling).
• Production experience with async Python (FastAPI, asyncio, Celery) and distributed background job pipelines.
• Background in CVE management, vulnerability correlation, and CVSS-based prioritization workflows.
• Practical experience integrating, serving, or consuming local LLMs and machine learning models within web application workflows and decision engines.
THE PERKS THAT WE OFFER:
Job ID: 152377179
