> Markdown version of [/jobs/ext/3039468-information-security-engineer](https://www.wearedevelopers.com/jobs/ext/3039468-information-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security Engineer - **Company:** Spyglass Solutions, Inc. - **Location:** United States (Remote available) - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Kubernetes Security, Software System Penetration Testing, Microsoft Azure, Software as a Service, Cloud Computing, Cloud Computing Security, Code Review, Cyber Security, Github, Identity and Access Management, Intrusion Detection and Prevention, Azure Active Directory, Phishing, Secure Coding, Software Vulnerability Management, Datadog, Software Security, Microsoft InTune, Microsoft Fabric, Static Application Security Testing - **Published:** September 23, 2026 - **Apply:** https://www.builtincolorado.com/job/information-security-engineer/11309583?handler=ApplyRedirect ## About the Role * 4-6 years of professional experience in information security, application security, cloud security, or a closely related role. * Experience in preparing for SOC 2 Type 2 attestations for SaaS products. * Hands-on experience securing SaaS applications and workloads running in Microsoft Azure. * Demonstrated experience with vulnerability management tooling and process including triage, prioritization (e.g., CVSS, EPSS, exploitability context), and driving remediation through engineering teams. * Working proficiency with several of the following: Microsoft Intune, Microsoft Defender (Endpoint/Cloud), Microsoft Purview, Datadog, GitHub (Advanced Security, Dependabot, code scanning), and Snyk. * Solid understanding of identity and access management concepts, particularly Microsoft Entra ID (Azure AD), conditional access, and least-privilege design. * Experience writing or substantially contributing to security policies, standards, or procedures. * Experience in responding to customer security questionnaires and supporting compliance efforts. * Strong written and verbal communication skills and able to translate technical risk for both engineers and non-technical stakeholders. Nice to Have: * Industry certifications such as CISSP, CCSP, AZ-500, SC-200, SC-100, GCIH, GSEC, or equivalent. * Experience with container and Kubernetes security. * Exposure to threat modeling, secure code review, or penetration testing. * Prior experience in a SaaS company or regulated industry. ## Description We are seeking a hands-on, mid-level Information Security Engineer to help protect our SaaS products, harden our cloud and endpoint environments, and mature our overall security program. This role sits at the intersection of technical security operations and governance. You will manage vulnerabilities across our products and infrastructure, contribute to corporate security policies, lead SOC 2 efforts, and serve as a key voice in customer and vendor security conversations. Our entire technology stack runs in Microsoft Azure, and we leverage the broader Microsoft security ecosystem (Intune, Defender, Purview) alongside best-in-class tooling like Datadog, GitHub, and Snyk. You will work closely with Engineering, IT, Legal, and Product teams to drive measurable improvements to our security posture. Responsibilities: Vulnerability & Product Security * Lead the company's SOC 2 compliance program, including readiness, control implementation, evidence collection, ongoing monitoring, remediation, and coordination with auditors through successful completion of the audit. * Lead the vulnerability management program across our SaaS products, cloud infrastructure, containers, and endpoints including identification, triage, prioritization, remediation tracking, and reporting. * Operate and tune SAST, SCA, and dependency-scanning tooling (e.g., Snyk, GitHub Advanced Security/Dependabot) and partner with engineering teams to drive timely remediation. * Monitor runtime and infrastructure telemetry (e.g., Datadog) for security signals; investigate alerts and lead containment and follow-up actions. * Track and report on vulnerability SLAs, mean-time-to-remediate, and other security KPIs to leadership. Cloud & Endpoint Security * Enhance the security posture of our Microsoft Azure environment including identity, networking, data, and workloads through configuration hardening, policy enforcement, and continuous monitoring. * Administer and improve Microsoft Intune for endpoint configuration, compliance, and mobile device management. * Tune and maintain Microsoft Defender (Endpoint, Cloud, and related products) for threat detection, response, and reporting. Governance, Risk & Compliance * Draft, update, and maintain corporate information security policies, standards, and procedures aligned to recognized frameworks (e.g., SOC 2, ISO 27001, NIST CSF). * Lead the response to customer and prospect security questionnaires, RFPs, and due-diligence requests, and maintain a reusable response library. * Support vendor risk assessments and third-party security reviews. * Assist with internal and external audits, evidence collection, and remediation of findings. Security Program & Collaboration * Partner with Engineering on secure SDLC practices, threat modeling, and code review guidance. * Contribute to security awareness training, phishing simulations, and a strong security culture across the company. * Help mature incident response playbooks and participate in tabletop exercises and on-call rotations as needed. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Debugging in the Dark](https://www.wearedevelopers.com/videos/1658-debugging-in-the-dark) - [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next) - [Securing Your Web Application Pipeline From Intruders](https://www.wearedevelopers.com/videos/53-securing-your-web-application-pipeline-from-intruders) - [Skynet wants your Passwords! The Role of AI in Automating Social Engineering](https://www.wearedevelopers.com/videos/770-skynet-wants-your-passwords-the-role-of-ai-in-automating-social-engineering) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)