> Markdown version of [/jobs/ext/3736630-information-security-solutions-engineer-ii](https://www.wearedevelopers.com/jobs/ext/3736630-information-security-solutions-engineer-ii). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security Solutions Engineer II - **Company:** Holman Enterprises, Inc. - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $105,050.0 - $149,700.0 - **Contract:** Temporary contract - **Skills:** Clean Code Principles, Kubernetes Security, .NET Framework, Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Application Testing, Microsoft Azure, Burp Suite, Cloud Computing, Cloud Computing Security, Cloud Engineering, Cyber Security, Information Systems, Information Leak Prevention, Query Languages, Software Design Patterns, Identity and Access Management, Intrusion Detection and Prevention, Information Systems Security Architecture Professional, Python (Programming Language), Node.Js, OAuth, Open Web Application Security, PCI Data Security Standards, Performance Tuning, Windows PowerShell, Role-Based Access Control, Openid Connect, Akamai, Ruby, Kusto Query Language, Security Information and Event Management, Software Engineering, Systems Integration, Tisax, Data Logging, Scripting, Office365, Large Language Models, Sonatype, Software Security, Mitre Att&ck, Veracode, Generative AI, Microsoft InTune, National Institute of Standards and Technology Cybersecurity Framework, AI Platforms, Information Technology, Bicep, Cloudflare, Checkmarx, CIS Benchmarks, Terraform, Prisma Cloud Platform - **Published:** October 14, 2026 - **Apply:** https://holmanautogroup.wd1.myworkdayjobs.com/HolmanEnterprisesCareers/job/Remote-NJ-US/Information-Security-Solutions-Engineer-II_R0056828 ## About the Role * 5-7 years of combined information security and technical engineering experience, with significant time in cloud security, application security, or both. * Strong experience securing Microsoft Azure and Amazon AWS environments in cloud-native and hybrid architectures. * Hands-on experience writing and maintaining infrastructure as code with Terraform (Terragrunt a plus), ARM, and/or Bicep. * Ability to read and reason about application code in at least one of .NET, Python, Ruby, or Node.js, well enough to explain a vulnerability and its fix to a developer. * Strong working knowledge of OWASP Top 10, OWASP API Security Top 10, threat modeling methodologies (e.g., STRIDE), and secure software development practices. * Working knowledge of cloud and application identity: Entra ID and AWS IAM, managed identities and service principals, RBAC and least privilege, and OAuth 2.0/OpenID Connect. * Experience operating application and cloud security tooling, such as CNAPP/CSPM (e.g., Wiz, Prisma Cloud, Orca Security, CrowdStrike Falcon Cloud Security), application security testing (e.g., Contrast Security, Checkmarx, Veracode, Snyk, Black Duck Seeker), and API security (e.g., APISec, Salt Security, Traceable, 42Crunch, StackHawk). * Experience with manual application testing tools such as Burp Suite or OWASP ZAP. * Experience performing third-party vendor security assessments. * Familiarity with edge, WAF, and CDN platforms such as Cloudflare, Akamai, Fastly, or Imperva. * Working knowledge of Microsoft Windows and the Microsoft 365 suite, including Entra ID and Intune. * Familiarity with security frameworks such as MITRE ATT&CK, NIST CSF, NIST 800-53, CIS Controls, and ISO 27001/27002. * Strong scripting ability in Python or PowerShell. * Clear communicator who can explain technical risk to developers, vendors, and management. Preferred * Defensive security experience: incident response, EDR, SIEM investigation and query languages (e.g., KQL, SPL), or detection engineering. * AI security experience: securing LLM-based applications and agents, MCP servers and gateways, or LLM routers, with familiarity in OWASP Top 10 for LLM Applications, MITRE ATLAS, or NIST AI RMF. * Experience with cloud FinOps practices and observability platforms (logging, metrics, tracing), particularly as applied to AI and security workloads. * Container and Kubernetes security experience (e.g., AKS, EKS), including image scanning and runtime protection. * Experience working with penetration testing, PTaaS, or crowdsourced security testing providers. * Familiarity with PCI DSS, ISO 27001, GDPR, NYDFS Part 500, and TISAX. Compliance is owned by a dedicated GRC team; this role supports implementing the technical controls behind it. * Certifications such as CISSP, GIAC (GCSA, GWEB, GCIH, or similar), OSCP, AWS Security Specialty, or Azure Security Engineer (AZ-500). Education and/or Training * Bachelor's degree in Information Security, Computer Science, Information Systems, or a related field, or equivalent work experience. ## Description * Review cloud security solutions and contribute to secure architecture designs for Azure and AWS environments, turning business requirements into practical security controls. * Provide security architecture guidance and design patterns to Infrastructure, Cloud, and Development teams. * Build, deploy, and maintain security infrastructure as code with Terraform, Terragrunt, ARM, and Bicep, so that controls stay consistent, version-controlled, and repeatable. * Perform third-party vendor security reviews: assess vendor architecture, controls, and risk, document findings, and recommend mitigations or acceptance criteria. * Contribute to the security architecture and operation of enterprise AI platforms, including MCP gateways, LLM routers, and AI gateways. This covers access control and tool permissions, prompt injection and data leakage risks, AI usage and cost governance (FinOps), and observability and logging of AI activity. * Keep documentation of security controls, configurations, architecture decisions, and procedures accurate and current. Software Security * Perform threat modeling with development teams on new and existing applications, and work with developers to understand vulnerabilities and architectural security issues, supporting remediation through to verified closure. * Support the IAM team on cloud and application identity security, including workload and managed identities, service principals, least-privilege role design, secrets handling, and application authentication and authorization patterns. * Administer and maintain application and cloud security tooling, including cloud security posture, runtime application security, and API security testing platforms. This covers configuration, tuning, integrations, and keeping findings accurate. * Help integrate security controls and testing into CI/CD pipelines and developer workflows. * Work with third-party penetration testing providers to support scoping, ongoing attack surface assessment, results triage, and remediation tracking. * Report vulnerability exposure, remediation status, and risk to application owners and management. Incident Response & General * Participate in incident response activities, contributing cloud and application security expertise to investigation, containment, and remediation. * Lead specific initiatives or workstreams when delegated. * Share knowledge with peers and developers on secure design and coding practices. * Stay current on cloud and application threats, attack techniques, and security technologies, and recommend improvements to Holman's security posture. * Perform other duties and special projects as assigned.