Security Engineer – Application Security & Identity

About the role

Real Chemistry is seeking a Security Engineer who will own application security across multiple environments, from AI‑assisted prototypes to enterprise production. The role involves reviewing security controls, defining identity architecture, and ensuring compliance with SOC 2 and other regulatory requirements while collaborating with development teams.

Key responsibilities

• Conduct security reviews of internally developed applications, including data‑flow validation, security control design, secrets handling, and AI/LLM data loss prevention.
• Co‑lead production‑readiness reviews for governed environments, covering threat modeling, hardening validation, and compliance mapping (SOC 2, contractual and regulatory).
• Define and enforce corporate and workload identity architecture using Entra ID, AWS IAM, and GitHub OIDC.
• Manage GitHub native security controls: Advanced Security (CodeQL/SAST), Dependabot, secret scanning, branch protection, and environment controls.
• Establish standards for security tooling such as SAST (CodeQL, Semgrep), SCA (Dependabot, Snyk), container scanning (Trivy, ECR scanning), and IaC policy (OPA, Sentinel, tfsec).
• Define AWS security standards, including IAM design, least‑privilege access, logging, audit requirements, and secrets rotation.
• Scope and coordinate third‑party penetration testing and maintain audit‑logging maturity per environment.

Required profile

• Proven ability to conduct comprehensive security reviews of applications.
• Experience with threat modeling and hardening validation.
• Familiarity with compliance frameworks such as SOC 2.
• Knowledge of corporate and workload identity solutions (Entra ID, AWS IAM, GitHub OIDC).

Required skills

• AWS
• GitHub Advanced Security
• Entra ID
• AWS IAM
• GitHub OIDC
• CodeQL
• Semgrep
• Dependabot
• Snyk
• Trivy
• ECR scanning
• OPA
• Sentinel
• tfsec

What we offer

• Hybrid work model with options to work onsite in US offices or remotely.
• Opportunity to shape security practices in a leading healthcare communications agency.
• Collaborative culture focused on innovation and impact.