Senior Security Engineer
Summary
Senior security engineer owning security end-to-end at IcyBox, a NYC-based watch/mystery-box commerce brand: finding and fixing vulnerabilities in mobile, web, and backend apps, securing AWS, running threat modeling and incident response, adding CI/CD security checks, managing pen tests and bug bounties, and supporting PCI DSS compliance. In-person in NYC five days a week.
Our Mission
Everyone knows the feeling of opening something unexpected and loving it. IcyBox turns that feeling into a business. We started as a watch commerce and mystery box company and are building a consumer brand people trust and come back to. We move fast, sweat the details, and are still writing our playbook.
Our Values
Move Fast, Build Right: Ship today, fix tomorrow.
Own the Gap: If nobody owns it, we step in.
Clarity Is a Gift: Turn noise into decisions and action.
Trust Over Title: Follow-through beats position.
Say the Real Thing: Hard conversations happen early.
Do the Unglamorous Work: No task is beneath us.
About the Role
We’re hiring a Senior Security Engineer to protect IcyBox, our customers and their data. You’ll own security across our apps, cloud infrastructure and internal systems, and help the team build securely without slowing down. This role is in person at our New York City office, five days a week.
What You’ll Do
Find and fix vulnerabilities across our mobile, web, and backend apps
Secure our AWS environment, including access management, networking and secrets
Run threat modeling and security reviews for new features
Build security checks into CI/CD, such as code scanning and dependency checks
Lead incident detection and response, including logging, alerting and playbooks
Follow security news and disseminate relevant information to the team
Prevent account takeover, bots and abuse on our site and app
Manage penetration tests, bug bounty reports and vendor security reviews
Support compliance work such as PCI DSS and privacy laws
Train engineers on secure coding
What We’re Looking For
5+ years in security engineering, application security or cloud security
Hands-on experience securing AWS environments
Strong understanding of web and mobile application security, including the OWASP Top 10
Able to read and write code in at least one language, such as Rust, Python, Go or TypeScript
Experience leading incident response
Able to explain risk clearly and give engineers practical fixes
Nice to Have
Experience working with production Rust, React, and React Native systems
E-commerce or payments security experience, including PCI DSS
Fraud, bot and account takeover prevention
SIEM tools and detection engineering
Certifications such as OSCP, CISSP or AWS Certified Security – Specialty
First security hire or early security team experience at a startup
Skills
As published by ashby
Name, Email, Resume
