Senior Security Engineer

United States·Tempefull-timesenior

EngineeringSecurity Engineer

0 views0 saves0 applied

Apply Now

Quick Summary

Overview

RevolutionParts is not just a pioneering force in the automotive eCommerce realm; we're actively seeking passionate and talented individuals to join our squad of Revolutionaries (yes,

Technical Tools

EngineeringSecurity Engineer

RevolutionParts is not just a pioneering force in the automotive eCommerce realm; we're actively seeking passionate and talented individuals to join our squad of Revolutionaries (yes, that's what we call ourselves!). As leaders in providing streamlined, user-friendly solutions, we empower automotive brands to maximize online sales. Our commitment to technology, top-notch customer service, and a profound understanding of the automotive market sets us apart. If you're ready to revolutionize the eCommerce space for automotive parts and accessories, consider joining our dynamic team of Revolutionaries.

AI Fluency & Modern Tooling

At RevolutionParts, we expect team members to actively use modern tools — including AI-powered systems — to improve decision-making, productivity, and quality of work.

This includes:

Using AI tools responsibly to accelerate research, analysis, documentation, and problem-solving
Exercising strong judgment around data privacy, accuracy, and ethical use
Continuously learning and adapting as AI capabilities evolve

Proven examples of using AI to improve outcomes in prior roles is expected.

The Role

RevolutionParts is an automotive eCommerce platform. AI is raising both the speed and the complexity of attacks and of vulnerability discovery, and we intend to meet that pace with AI of our own. Our CloudOps team is becoming a CloudSecOps team, and we are hiring a security engineer who puts AI at the center of the work to continuously find where we are exposed, set up the systems and practices that keep us secure, and help the people around you get better at security.

What this role is: analysis, prevention, and the delegation of work. You will find and prove our weaknesses across cloud, applications, and third-party tools, rank them by real risk, and get them to the right owner. This role does not take on day-to-day CloudOps requests or the infrastructure on-call rotation; the CloudOps team keeps that work.

How AI fits: we expect you to lean hard on AI. Use AI-assisted scanning, code review, and triage to find issues faster than a person could, automate the repeat work, and set up guardrails and detection so the program runs on a steady rhythm. You will also define how our engineers use AI safely.

You guide teams through the fixes that belong to them; you do not take on the work in their stack. You will write code of your own, though: scripts, automation, detections, and security tooling, much of it built with AI. Much of the job is coordination: chasing down answers, getting the right people in a room, and following up with stakeholders and owners until the work is done. This is not a role that writes a report and moves on. You find the problem, get it to the right owner, and stay on it until it is fixed.

Responsibilities

~1 min read

Run AI-assisted scanning of our code, infrastructure, and cloud configuration, and triage the results into real, ranked findings
Test our applications the way an attacker would, through pentesting and ethical hacking, with a focus on business logic flaws in checkout, account, and payment flows
Run quarterly access reviews, and ensure that SSO and MFA stays consistent across the SaaS tools we manage
Review our AWS, Kubernetes, and infrastructure-as-code setup for weaknesses in identity, encryption, secrets, and network controls, and hand clear, prioritized fixes to the owning teams
Own our pentest and bug bounty work: scope it, triage what comes in, give each finding an owner and a severity-based deadline, and verify every fix
Set our edge security policy as we modernize: WAF and bot management (letting search engines and approved AI crawlers through while blocking malicious bots), TLS, DNS, and certificates

Watch AWS security signals and our SIEM and EDR; keep endpoint coverage complete across servers, clusters, and devices; and lead the security side of incidents alongside our incident commander
Get full value from the security tools we already have, starting with our SIEM: bring in the right data sources, build and tune detections, cut noise, and show leadership what each tool delivers
Own code security day-to-day in GitHub and our code analysis tools: dependency alerts, code and secret scanning, quality gates on pull requests, branch protection, and repository access, with findings routed to the right teams
Help design and run tabletop exercises with the infrastructure team, owning the security scenarios
Coordinate our response when a widely exploited vulnerability hits (think Log4Shell), drive patching to completion, and document risk acceptance when we choose not to patch
Keep our compliance work (SOC 2, ISO 27001, PCI DSS, security questionnaires, partner assessments, quarterly PCI ASV scans, and the Trust Center) on schedule, and use AI and a compliance platform to automate evidence collection and questionnaire drafting so it stays a small share of your time
Keep our contractual security obligations visible and our security processes documented
Define how engineers use AI safely: what data can and cannot go to AI tools, prompt-injection risks, and how to review AI-generated security suggestions
Set best practices for handling PII and route them to the teams that own each system

Build guardrails so issues do not come back: policy-as-code, organization-level controls, and security checks in CI/CD and GitHub
Mature detection and incident readiness, including runbooks and response playbooks
Defend against AI-accelerated attacks: shorten the time from a disclosed vulnerability to a verified fix, harden identity and email against AI-written phishing and impersonation, detect automated credential and bot abuse, and help shape the roadmap for where we invest next
Evaluate security tools from the major vendors and automate recurring scans, ticket creation, and reporting

Strong cloud security teams measure outcomes, not activity. Here is how we will know this role is working.

Early on

You know our environment end to end and have a risk-ranked plan the team agrees on
AI-assisted scanning runs on a regular schedule and produces triaged findings, not raw noise
Every open security finding has an owner, a severity, and a due date

Over time

Vulnerabilities are fixed within severity-based timelines, internet-facing critical issues first, and exceptions are documented as risk acceptances; the time from a public exploit to our fix keeps shrinking as attackers get faster
Security controls live in code, and guardrails catch misconfigurations before they reach production, so fewer new findings appear each quarter
Our security tools earn their cost: the right data flows into the SIEM, detections are tuned, and time to detect and respond keeps improving
Audits, scans, partner assessments, and questionnaires are completed on time with evidence ready, not in a scramble
Incident runbooks are tested in tabletop exercises and improved after every incident
Leadership gets a regular, plain-language view of security risk and trends, and application teams bring security questions to you early
The CloudSecOps team and engineering teams handle more security work on their own, because you have helped them learn how

5+ years in cloud, infrastructure, application, or security engineering, with recent years focused on security
Strong working knowledge of cloud infrastructure, especially AWS: IAM, encryption, logging, network controls, and native security services, enough to find flaws and guide the fix
Able to read infrastructure as code (Terraform) and spot security misconfigurations, and comfortable scripting in Python, Bash, or similar to automate scans, detections, and reporting
A track record of driving security remediation: pentest and scan findings, patching, and widely exploited vulnerabilities, driven to verified closure across teams
Experience in SOC 2, ISO 27001, or PCI DSS environments at an eCommerce company or a high-traffic SaaS platform: access reviews, audit evidence, questionnaires, and third-party assessments, including working with auditors
Experience with vulnerability management and incident response
Application security testing experience (pentesting or ethical hacking), especially business logic flaws in web apps; strongly preferred
Hands-on use of AI in security work, such as AI-assisted scanning, triage, or code review, with a clear view of how to use AI safely
Security certifications such as CISSP, CISM, Security+, or equivalent strongly preferred
Excellent written communication skills; comfortable writing clear, accurate responses for customer-facing security documentation
Hands-on experience running a SIEM and EDR: building and tuning detections, investigating alerts, and leading incident response
Strong follow-through, clear writing, and a habit of teaching: you work independently, help others grow, use AI tools daily, and learn and unlearn quickly, letting go of tools and habits that AI or new threats have made obsolete

Nice to Have

~1 min read

EDR, WAF, and bot management platforms
Kubernetes (EKS) and container security
Building preventive guardrails: policy-as-code, AWS organization controls, and security checks in CI
Secrets management with HashiCorp Vault or similar, and Zero Trust remote access
A compliance automation platform such as Vanta, Drata, or Delve, plus GitHub security features and static analysis tools
Writing Terraform
Working with AI to build in house security tooling to assist in the awareness and remediation of security vulnerabilities
Security certifications (AWS Security Specialty, Security+, CISSP, or similar)

If you meet most of what is listed here and the work excites you, we would like to hear from you.

Autonomy: you decide how we find our weaknesses and how we prevent them
Build the function: help turn CloudOps into CloudSecOps and shape how security works here
AI tooling: we are AI-first, and you will have room to build how we use AI to find and prevent security problems
Real impact: your work protects a high-traffic eCommerce platform that automotive businesses and their customers rely on every day
Mentor and grow others: raise the security skills of the engineers you work with
A real bias for action: we make decisions quickly and ship; good ideas do not wait months for approval

*Please note that this is a hybrid role that requires that you work from our Tempe, Arizona, offices at least 2 days per week.

RevolutionParts is proud to provide all full-time Revolutionaries with a comprehensive employment package including competitive compensation, career development, benefits, 401K match, parental leave, and many more valuable perks. You can learn more about our core-value driven culture at our career page.

RevolutionParts is an Equal Opportunity Employer; we value diversity. We do not discriminate on the basis of race, religion, color, national origin, gender, gender orientation, gender identity or expression, sexual identity, sexual orientation, age, marital status, family status, genetic information, veteran status, or disability status.

Please Note: You will only receive correspondence through the Gem ATS or from a @revolutionparts.com email address. If you are receiving communication through any other platform or domain, it may be fraudulent, and we urge you to ignore the communication.