> Markdown version of [/jobs/ext/4224893-lead-security-engineer](https://www.wearedevelopers.com/jobs/ext/4224893-lead-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead Security Engineer

- **Company:** Prelim LLC
- **Location:** Chicago, IL, United States (Remote available)
- **Experience:** Expert
- **Salary:** $240,000.0 - $260,000.0
- **Contract:** Permanent contract
- **Skills:** Software System Penetration Testing, Cloud Computing Security, Static Program Analysis, DevOps, Identity and Access Management, Intrusion Detection and Prevention, Key Management, Network Architecture, Systems Development Life Cycle, Anti-Phishing, Security Information and Event Management, Data Streaming, Data Logging
- **Published:** October 6, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=6bfd24a0592d1e1d

## About the Role

* 5+ years in security engineering, with breadth across appsec, cloud security, and compliance.
 * Hands-on: you can read code, write scripts, and configure cloud controls yourself
 * You've owned or heavily contributed to a SOC 2 audit (or ISO 27001 / equivalent)
 * Experience answering enterprise or financial-institution security reviews.
 * Strong written communication.
 * Judgment about proportionality: you know which risks matter at our scale and which controls are theater

Nice to have

 * Fintech or banking-vendor experience; familiarity with FFIEC, GLBA, or bank third-party risk management
 * Experience as a first or early security hire
 * Detection engineering / SIEM experience
 * Familiarity with core banking integrations or handling of PII/KYC data flows

## Description

* Secure SDLC: dependency scanning, static analysis, security review of high-risk changes, and coordinating annual penetration tests. Teach engineers to catch issues before you have to.
 * Partner with DevOps on IAM, secrets management, network architecture, logging, and detection.
 * Policies, risk assessment, and roadmap. Decide what a company our size and risk profile actually needs, and defend that reasoning to auditors, bankers, and internally.
 * Own security questionnaires, vendor risk assessments, and customer security reviews. Banks conduct rigorous third-party risk management (often against FFIEC guidance).
 * Endpoint management, access reviews, phishing resistance, offboarding hygiene. The unglamorous stuff that questionnaires ask about first.
 * Own SOC 2 Type II end to end: control design, evidence collection, auditor management.
 * Owning incident response, from writing the plan, to running the tabletops, and leading if it's ever real. Banks have breach-notification expectations in their contracts. You'll know them cold.