Staff Security Automation Engineer

Beyond Finance is dedicated to helping everyday Americans escape the cycle of crippling debt. The Staff Security Automation Engineer will build and deploy controls and automation to enhance the security team's capabilities across various systems.

Responsibilities:

• Build and own our security log pipelines: get logs out of the systems that produce them, transform and enrich them, and land them in our SIEM where the team can detect and investigate. This is a large part of the role
• Operate and improve our SIEM: onboard new sources, and build and tune the detections and alerts the team runs on
• Deploy and tune security controls across our endpoint fleet of managed macOS and Windows workstations and AWS WorkSpaces virtual desktops running Windows Server
• Build internal tooling and automation that makes the team and our processes better, from removing manual toil in triage and remediation to giving the team capabilities it doesn't have today. When it calls for custom code, it's primarily Python
• Instrument our environment for security signal by integrating our tooling through their APIs and writing the connective code that ties the stack together
• Establish secure defaults in our Infrastructure as Code through reusable modules and policy as code
• Build security into CI/CD: scanning, secrets detection, and policy-as-code gates that live in the developer workflow
• Treat the pipelines and tooling you build as a platform you own, including their reliability and coverage
• Work directly in systems your team does not own: read the code or infra, make the change safely, and get it through review rather than filing a ticket

Requirements:

• 8+ years of hands-on security engineering with a focus on automation, tooling, and instrumentation
• Comfortable writing custom code and scripting, primarily in Python, to build your own tooling and log pipelines from scratch. You do not have to be a career software engineer, but you are well past copy-and-paste
• Hands-on experience building and operating log pipelines end to end: collection, parsing, enrichment, and delivery into a SIEM
• Hands-on SIEM experience: onboarding sources and building or tuning detections and alerts
• Experience deploying and managing endpoint security across a mixed fleet of macOS and Windows workstations, including virtual desktops
• Hands-on Infrastructure as Code experience; Terraform required
• Experience building CI/CD pipelines and wiring security checks into them
• Working knowledge of a major cloud provider, ideally AWS
• Operates independently and drives projects without day-to-day oversight
• A background in Cloud Security or Application Security to build on from a more automation-focused seat
• Experience with our stack: Wiz, Cloudflare, GitHub Advanced Security, Spacelift, and AWS-native services
• Policy as code experience such as OPA/Rego or Sentinel
• Experience with a SIEM or log platform as a pipeline destination
• AI/ML security exposure: prompt injection, data poisoning, model abuse, and the controls that mitigate them
• PCI-regulated or financial services environment
• Familiarity with Ruby on Rails, Python, or Go