> Markdown version of [/jobs/ext/2105037-security-operations-engineer](https://www.wearedevelopers.com/jobs/ext/2105037-security-operations-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Operations Engineer - **Company:** SunCore Digital LLC - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $165,000.0 - $205,000.0 - **Contract:** Permanent contract - **Skills:** Flutter, Microsoft Access, Application Programming Interfaces (APIs), Artificial Intelligence, User Authentication, Cloud Computing, Cloud Computing Security, Static Program Analysis, Cyber Security, Databases, Continuous Integration, DevOps, Digital Assets, Disaster Recovery, File Systems, Failover, Identity and Access Management, Mobile Application Software, Operational Data Store, Operational Databases, Role-Based Access Control, Secure Coding, Session Management, Mobile Security, Systems Integration, Web Applications, Data Logging, Data Processing, Software Security, Backend, Firewall Services Module, Devsecops, Vulnerability Analysis - **Published:** August 18, 2026 - **Apply:** https://www.builtincolorado.com/auth/login?destination=/job/senior-security-operations-engineer/10712857 ## About the Role * Five or more years of experience in security engineering, DevSecOps, cloud security, application security, security operations, or a comparable role. * Hands-on experience remediating security issues. * Experience securing cloud-hosted applications and infrastructure. * Experience reviewing authentication, authorization, permissions, and data isolation. * Experience with CI/CD security integration. * Experience with vulnerability, dependency, secret, and static-analysis tooling. * Strong understanding of identity, access, service accounts, secrets, and least privilege. * Experience reviewing web applications and APIs. * Familiarity with mobile application security. * Experience with security monitoring and incident response. * Ability to assess third-party and operational security risks. * Strong technical documentation and communication skills. * Ability to distinguish confirmed vulnerabilities, suspected risks, and unassessed areas. * Comfort working in a small organization where security practices are still being established. Bonus Points * Experience preparing a platform for its first external users. * Experience establishing security practices in a startup or small engineering organization. * Familiarity with crypto, fintech, digital assets, KYC, AML, or payment-related systems. * Experience with Flutter or mobile application security. * Experience securing disaster-recovery, backup, or privileged automation systems. * Experience with infrastructure as code or containerized platforms. * Experience in a remote, asynchronous environment. ## Description SunCore Digital is seeking a hands-on Senior Security Operations Engineer to assess and improve the security of our applications, cloud environments, development practices, identities, data, and operational tooling. This role will establish practical security standards, build and harden shared security controls, investigate risk, and review security-impacting implementations produced by reliability, recovery, DevOps, and application teams. System-owning teams remain responsible for remediating their applications and services and for operating routine system-specific controls after enablement. This is not a role that manually approves every normal software release. Security review will focus on defined risk areas, including changes involving privileged access, sensitive data, recovery systems, network exposure, secrets, infrastructure, authentication, authorization, and security controls. Responsibilities Security assessment * Assess the current security posture across web applications, Flutter mobile applications, APIs, backend services, cloud infrastructure, repositories, CI/CD, databases, and integrations. * Inventory externally accessible services and endpoints. * Identify vulnerabilities, insecure defaults, excessive permissions, unmanaged credentials, and control gaps. * Distinguish confirmed findings from suspected risks and unassessed areas. * Prioritize findings based on exploitability, potential impact, exposure, and launch relevance. * Define remediation requirements and work with system owners, who implement and maintain application- and service-specific fixes. Implement shared security controls where the control belongs to the security function. * Verify that critical findings are resolved effectively. Identity and access management * Review access to cloud accounts, repositories, databases, CI/CD systems, production environments, and third-party services. * Identify former employee, contractor, shared, excessive, or undocumented access. * Establish least-privilege and access-review practices. * Review service accounts, machine identities, API credentials, and privileged roles. * Define and harden credential lifecycle requirements, and work with DevOps, platform staff, and system owners to implement appropriate issuance, storage, rotation, revocation, and emergency-access mechanisms. * Ensure critical access activity is logged where appropriate. * Support role-based access and authorization reviews. Application and API security * Review authentication, authorization, session management, permissions, and data isolation. * Assess exposed APIs, input handling, file processing, sensitive-data handling, and administrative functions. * Independently assess high-risk negative-access paths and direct access to restricted endpoints. * Work with QA and developers to convert repeatable security scenarios into regression coverage owned by the applicable delivery team. * Review changes involving sensitive workflows or new public exposure. * Help establish secure coding and review expectations. * Support threat modeling for critical workflows and material architectural changes. Mobile security * Assess mobile authentication, session handling, secure storage, API access, application permissions, logging, and sensitive-data exposure. * Review risks related to device storage, screenshots, notifications, local caches, and mobile configuration. * Work with the Mobile QA Engineer and mobile developers on security-related testing. * Review mobile release practices where they affect application security. Security tooling and automation * Define, implement, and harden security-specific automation, including dependency scanning, secret scanning, static analysis, vulnerability scanning, and container or infrastructure scanning where appropriate; establish the long-term owner for each shared control before handoff. * Define security policies, rules, and acceptance thresholds; work with DevOps to integrate shared controls into CI/CD and with repository owners to maintain application-specific configuration. * Establish actionable security gates based on severity and context, while system owners remain responsible for remediation. * Avoid creating low-value controls that block delivery without reducing material risk. * Improve security finding visibility and reporting. * Define exception and escalation procedures. * Track critical remediation through verification. Review of reliability and recovery implementations * Review security-impacting SRE and Disaster Recovery implementations before production adoption. * Evaluate changes involving: + Privileged automation + Service accounts + Secrets + Backup data + Recovery access + Network or firewall configuration + Infrastructure permissions + Failover paths + Sensitive logging or monitoring * Review DevOps, dashboard, and internal-tooling changes when they affect access, production data, infrastructure, or security controls. * Validate that operational improvements do not introduce avoidable security exposure. Security operations and incident readiness * Establish security monitoring and escalation requirements. * Develop security incident-response procedures and runbooks. * Define initial security incident severity and notification paths. * Investigate security events and suspicious activity. * Support evidence preservation and technical incident analysis. * Conduct or coordinate security exercises. * Track post-incident corrective actions. * Ensure security runbooks are tested by qualified staff. Data and vendor security * Identify where sensitive, personal, financial, or operational data is stored and transmitted. * Review encryption in transit and at rest. * Assess retention, deletion, export, logging, and access behavior. * Review third-party services that receive code, credentials, operational data, or sensitive information. * Support vendor security review based on business risk. * Help identify security and privacy obligations that require legal or compliance input. Collaboration * Work with developers to remediate application findings. * Work with SRE on logging, monitoring, incident readiness, and security-relevant reliability controls. * Work with the Disaster Recovery and Resilience Engineer on backup, restoration, emergency access, and recovery security. * Define security requirements for CI/CD and shared infrastructure; work with DevOps and platform staff to implement them, and with system owners to maintain application-specific configuration. * Work with QA on permissions, authorization, data isolation, and regression scenarios. * Provide clear technical findings and risk information to leadership. Initial Priorities * Inventory production access, service accounts, secrets, and publicly accessible endpoints. * Review former employee, contractor, and shared access. * Establish and harden shared dependency- and secret-scanning capabilities, coordinate CI/CD integration with DevOps, and assign remediation ownership to the applicable repository teams. * Assess authentication, authorization, and customer-data isolation. * Review critical cloud and infrastructure permissions. * Identify launch-critical security findings. * Establish security review triggers for high-risk changes. * Implement initial security monitoring and incident procedures. * Review SRE and recovery mitigations that affect production security. * Create a factual security-readiness assessment., Lead strategic sourcing and procurement across the organisation: develop category strategies, manage supplier relationships and contracts, drive cost savings and risk mitigation, ensure governance and compliance (UK), champion sustainability/ESG and digital procurement, and lead and mentor procurement teams while partnering with senior stakeholders. Top Skills: AribaJaggaerOracleSAP Atlassian Customer Success Manager 10 Hours Ago Remote Senior level Senior level Cloud * Information Technology * Productivity * Security * Software * App development * Automation Manage enterprise customer relationships to drive adoption, expansion, and value realization across Atlassian products. Develop Success Plans, run QBRs, mitigate churn, collaborate with account teams, and provide customer feedback to internal teams to support product and business outcomes. Top Skills: AIBi ToolsConfluenceGainsightJIRASaaSSalesforceTableau What you need to know about the Colorado Tech Scene With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation. Key Facts About Colorado Tech * Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey) * Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3 * Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech * Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook) * Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures * Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Developing the Backend with Stefan Lingler, CTO at Shpock](https://www.wearedevelopers.com/videos/100360-developing-the-backend-with-stefan-lingler-cto-at-shpock) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [Flutter Packages and Plugins - A Look Under the Hood](https://www.wearedevelopers.com/videos/555-flutter-packages-and-plugins-a-look-under-the-hood) - [Intro to Flutter Development](https://www.wearedevelopers.com/videos/170-intro-to-flutter-development) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) ## Related Articles - [Basic And Advanced Networking in Dart and Flutter](https://www.wearedevelopers.com/magazine/112-basic-and-advanced-networking-in-dart-and-flutter) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)