AppSec Engineer

ShipMonk is a fast-growing 3PL whose operations run 24/7 across Europe and the US. Our Security team covers compliance, incident response, identity, and security operations for the whole company. We're hiring an engineer who will work across all of these areas rather than specialize in one. Your time will be split roughly evenly between day-to-day operations and building the capabilities we don't have yet. AI is part of how we work. We expect you to adapt quickly and use AI tools to improve work efficiency and strengthen our company's security posture.

Responsibilities:

• Challenge existing development practices and drive a security-first mindset across engineering teams.
• Identify and assess vulnerabilities in our applications through internal penetration testing.
• Build and maintain automated vulnerability discovery in the CI/CD pipeline.
• Educate developers on secure coding practices.
• Own Okta security policies and privileged access.
• Triage, contain, and analyze incidents.
• Automatically read and process logs, and set up automated playbooks.
• Secure Google Workspace, SSO/SAML integrations, and third-party OAuth apps.
• Understand vulnerabilities, patching, and stakeholder management.
• Support SOC 2 Type II, GDPR, and ISO27001 security frameworks.
• Use AI tools for investigations, log analysis, and detection writing.
• Run security communications, phishing simulations, and tabletop exercises.

Requirements:

• 3+ years in security engineering, security operations, or similar role.
• Hands-on experience with incident response and log analysis.
• Strong IAM skills: Okta or a similar identity provider, SSO/SAML, MFA.
• Experience securing cloud and SaaS environments.
• Experience with a SIEM and writing detection rules.
• Scripting skills (Python or similar) and comfort working with APIs.
• Working knowledge of SOC 2 or ISO 27001.
• Hands-on use of AI tools.
• Fluency in English.

Nice to have: Vanta, Datadog, Snowflake, GitLab, or threat hunting experience.

Why join: You'll be building a security function, not maintaining one. Half your time goes to things we don't have yet: detection engineering, automated playbooks, threat hunting.