Senior Information Security Engineer

About the Role

Priority #1 for this role: close the gaps our recent external audit found, then keep pushing our attack surface tighter from there, so our websites and client portals stay up and untampered, our email domains can't be used to scam people, and our data doesn't walk out the door. No security posture is ever fully "done", what we want is someone who keeps this at the top of their list, not squeezed in between other things.

We're hiring a Senior Information Security Engineer to own the external security of our company websites and client-facing portals, our email domains, and our data. You'll work closely with our DevOps team (who own infrastructure execution) and our in-house developers (who own application code) to get fixes shipped, and you'll run our external pentest/audit program as the outside check that it's actually working.

There's a secondary layer of work too (access governance across our ~40-service SaaS portfolio, evaluating security tooling). You own that as far as your bandwidth allows. If it starts eating into the primary mission, that's your signal to make the case for hiring someone under you, not to let either side slip.

Reports to: CIO

Key Responsibilities

Priority #1: close and keep closing the external attack surface

• Own the security and integrity of our public websites and client-facing portals: hardened access to DNS/CDN/hosting panels so changes can't happen outside a controlled process, removal of wildcard DNS records, closing of exposed admin/API endpoints

• Stop email spoofing and account takeover: SPF and DMARC on every company domain, moved all the way from p=none to p=reject, with DKIM verified for every sending system (Google Workspace, Zoho, SendPulse, and others), plus enforced 2FA/phishing-resistant login and anomalous-login monitoring on Google Workspace, especially for sales staff. This is what actually stops the costliest scenario for a real estate business: someone hijacking a live deal thread to redirect…