Senior Product Security & DevSecOps Engineer

Employment Type: Full-time | Experience: 5–8+ years

Work Arrangement: Primarily in-office; no work-from-home flexibility

Working Hours: U.S. Central Time (evening/night shift in India)

About MIRA Labs
MIRA Labs is building an AI-powered mortgage technology platform that streamlines lending workflows, document processing, and decision-making for enterprise customers across the U.S. and Canada.
We are seeking a hands-on Senior Product Security & DevSecOps Engineer to own security across our applications, cloud infrastructure, CI/CD pipelines, and AI-powered systems.

Key Responsibilities

• Application & API Security: Secure React and Python/FastAPI applications, conduct code reviews, address vulnerabilities, and implement OWASP-aligned security controls.
• DevSecOps & CI/CD: Secure GitHub repositories and Actions workflows, implement automated security scanning, and protect software delivery pipelines.
• Cloud Security: Strengthen security across AWS and Azure, including IAM, Kubernetes, containers, networking, and infrastructure configurations.
• Identity & Secrets Management: Implement least-privilege access, MFA, credential rotation, and secure secrets management.
• Security Monitoring & Incident Response: Investigate security incidents, monitor suspicious activity, perform root-cause analysis, and improve response procedures.
• Vulnerability Management: Conduct security assessments, threat modeling, penetration testing coordination, and vulnerability remediation.
• AI & LLM Security: Protect AI agents and LLM integrations against prompt injection, data leakage, unauthorized tool execution, and cross-tenant access.
• Compliance & Governance: Support SOC 2, ISO 27001, ISO 42001, enterprise security assessments, and security documentation.

Required Qualifications

• 5–8+ years of experience in Application Security, Product Security, Cloud Security, or DevSecOps.
• Hands-on experience securing production SaaS applications and GitHub Actions CI/CD pipelines.
• Strong knowledge of AWS, Azure, IAM, OAuth 2.0, OIDC, JWT, RBAC, and secrets management.
• Experience with Python code reviews, REST API security, OWASP standards, and vulnerability remediation.
• Practical experience with SAST, DAST, SCA, secret scanning, and container security.
• Familiarity with Docker, Kubernetes, and infrastructure as code.
• Experience in security monitoring, incident response, and cloud log investigations.
• Strong problem-solving skills and the ability to work independently with engineering teams.

Preferred Qualifications

• Experience in fintech, banking, mortgage technology, or regulated SaaS.
• Familiarity with Azure Key Vault, HashiCorp Vault, AWS CloudTrail, AKS, and AWS ECS.
• Experience with SOC 2, ISO 27001, AI security, and OWASP LLM security guidance.
• Certifications such as OSCP, CSSLP, CISSP, AWS Security Specialty, or AZ-500 are a plus.

First 90-Day Goals

• Assess application, cloud, repository, and CI/CD security.
• Identify and prioritize critical risks.
• Implement essential security controls and automated scanning.
• Strengthen secrets management and privileged access.
• Establish monitoring, incident-response procedures, and a measurable remediation roadmap.
• Integrate security checks into the software release lifecycle.