Information Security & Platform Engineer

We are looking for an early-career engineer who wants to build a career in application and infrastructure security, and who already has real hands-on WordPress and PHP experience. That combination matters here: the most valuable security work on our platform is understanding plugin and theme code well enough to know what is actually exploitable, keeping a large fleet of sites patched and hardened, and closing the gap between a scan finding and a working fix.

This is a growth role with genuine responsibility, not a shadowing role. You will run day-to-day security operations and contribute directly to the platform. You will work under engineering leadership and alongside senior engineers who own risk decisions and lead incident response - you set the pace on the work, they backstop the judgment calls, and your scope expands as you demonstrate it.

How the role splits

Roughly 60% security and 40% platform engineering. The platform work is not filler - it keeps you fluent in the codebase you are securing, and it is where a lot of remediation actually lands. Your security objectives are committed and tracked alongside platform work each sprint, so proactive security does not get crowded out by day-to-day requests., * Vulnerability management - run scans, interpret results, triage findings by real-world exploitability, and drive remediation to closure with the engineers who own the code.

• WordPress and dependency security - own the patch cadence for core, plugins, themes, and third-party libraries; identify risky or abandoned dependencies and make the case for replacing them.
• Apply and maintain hardening baselines across Linux servers, web server configuration, and application settings.
• Help implement security controls: access reviews, secrets management, security logging and alerting, and TLS / certificate hygiene.
• Perform security-focused code review on PHP and JavaScript changes, and help triage findings from automated scanning in the pipeline.
• Participate in incident response - monitoring, triage, evidence gathering, documentation, and the lessons-learned process, working alongside the senior engineers who lead it.
• Support SOC 2 compliance - evidence collection, control documentation, and policy support.
• Track vulnerabilities and threats relevant to our stack, and translate them into prioritized, actionable tickets.

Platform Engineering & Operations

• Write and review PHP and JavaScript for the WordPress platform, with a focus on security fixes, hardening, and remediation work.
• Diagnose and resolve WordPress, PHP, and MySQL issues alongside the development and support teams.
• Assist with releases, deployments, and client site launches using internal automation scripts.
• Administer Ubuntu / Debian Linux servers: patching, monitoring, nginx configuration, log analysis, and routine maintenance.
• Work with DNS records, domain configuration, and SSL / TLS certificates across client site environments.
• Build small automations and scripts that reduce manual security and operations overhead., * A documented inventory of our production surfaces and the known security gaps on each, ranked by actual exposure rather than raw scanner severity.
• A running vulnerability management cycle - scan, triage, remediate, verify - on a predictable cadence.
• A consistent patch cadence for WordPress core, plugins, and dependencies across the fleet, with the riskiest gaps closed first.
• Several security fixes shipped by you, end to end, from finding to verified remediation.
• Clear documentation of what we run, what protects it, and what still needs attention., This role is designed to grow. As you build depth, the scope expands toward owning the vulnerability management program outright, leading incident response, and taking on security architecture input for new work. We will support relevant training and certification along the way.

• 1-3 years of professional experience in software development, systems administration, or IT with a demonstrated security focus. Strong internship, lab, home-lab, or CTF work counts toward this.
• Hands-on WordPress and PHP experience - you can read plugin and theme code, trace a bug through it, and write a fix. This is a hard requirement, not a nice-to-have.
• Solid security fundamentals: OWASP Top 10, authentication and authorization concepts, encryption and TLS basics, and common web attack vectors.
• Comfortable on the Linux command line: file system, process management, and log analysis.
• Scripting ability in Bash and / or Python.
• A working understanding of web application architecture - HTTP, DNS, TLS, APIs, and how a request actually reaches your code.
• Working knowledge of MySQL: writing queries and debugging data issues.
• Strong written communication - security work is documentation-heavy, and clear writing is a core part of the job.
• Genuine curiosity and a methodical approach. We would rather hire someone who digs until they understand the root cause than someone who already knows every tool.
• Must reside in the U.S. and be authorized to work without sponsorship.

Nice to Have

• Security certifications (e.g., CompTIA Security+, eJPT) or active pursuit of one.
• Hands-on experience with vulnerability scanners (e.g., Nessus, OpenVAS, Trivy, WPScan) or centralized logging / SIEM concepts.
• Exposure to SOC 2 or another compliance framework.
• Experience managing nginx: server blocks, proxy configs, rewrites, and SSL.
• Familiarity with a major cloud platform (e.g., GCP or AWS) and cloud IAM basics.
• Exposure to containers and container security.
• CI/CD familiarity (e.g., GitHub Actions) and pipeline security tooling - dependency scanning, SAST, DAST.
• Any exposure to modern TypeScript-based backend or frontend frameworks.
• Proficiency using AI-assisted tools in engineering and security workflows, with sound judgment on privacy and data handling.

Performs vulnerability management, WordPress and dependency security, Linux hardening, security-focused code reviews, incident response support, SOC 2 evidence collection, and platform engineering. Maintains PHP and JavaScript applications, Ubuntu/Debian servers, nginx, DNS, certificates, MySQL, deployments, and automation scripts. The role requires hands-on WordPress and PHP expertise, web security fundamentals, Linux command-line skills, scripting, and U.S. work authorization without sponsorship. The summary above was generated by AI

This is a remote position., Compensation & Benefits

• Remote - work from anywhere in the U.S.
• Unlimited PTO - performance-based flexibility
• 401(k) with employer matching
• Comprehensive healthcare - medical, dental, and vision
• Paid professional development
• Salary - $80,000 - $105,000

About Dealer Alchemist, Remote or Hybrid United States 97K-131K Annually Senior level 97K-131K Annually Senior level Cloud * Fintech * Software * Business Intelligence * Consulting * Financial Services Leads end-to-end quality assurance for Workday implementations, upgrades, and enhancements. Defines testing strategies, plans, frameworks, and risk mitigation; oversees functional, integration, regression, and UAT testing across Workday modules. Manages defects, test data, environments, release validation, reporting, and stakeholder sign-off. Coordinates QA activities among business teams, developers, system integrators, vendors, and delivery partners while ensuring adherence to quality standards and governance. Top Skills: Azure DevopsErpJIRAWorkday Wipfli

Tax Manager

35 Minutes Ago Remote or Hybrid 106K-160K Annually Senior level 106K-160K Annually Senior level Cloud * Fintech * Software * Business Intelligence * Consulting * Financial Services Manage tax compliance engagements, supervise staff, and ensure timely communication with clients while maintaining technical tax expertise. Top Skills: AdobeCasewareExcelIdeaPowerPointProsystemsRiaWord, Wipfli, Remote or Hybrid Senior level Senior level Cloud * Fintech * Software * Business Intelligence * Consulting * Financial Services Manage complex tax returns for partnership clients, evaluate partnership agreements, mentor staff, and ensure exceptional client service. Requires strong leadership in tax consulting and compliance. Top Skills: Tax-Related Software

What you need to know about the Colorado Tech Scene

With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation.

Key Facts About Colorado Tech

• Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey)
• Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3
• Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech
• Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook)
• Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures
• Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute

Dealer Alchemist is a digital advertising agency specializing in the automotive industry. We build and operate the platforms that power dealer websites and advertising campaigns at scale, combining deep domain expertise with modern engineering practices.