Senior Cybersecurity Engineer

Senior Cybersecurity EngineerWhat you will do:Compliance and Regulatory ProgramsOwn the operational execution of FGI Tech's NYDFS Cybersecurity Regulation 500 compliance program, including policy documentation, annual risk assessments, and regulatory filings.Maintain and continuously improve FGI Tech's ISO 27001 compliance posture; support audit preparation and evidence collection.Respond to client and prospect security questionnaires, due diligence requests, and information security reviews in support of the sales and CS teams.Maintain security policy documentation, control libraries, and audit evidence in an organized, audit-ready state at all times.Vulnerability Management and Penetration TestingConduct ongoing vulnerability assessments across the TRUST platform, cloud infrastructure, and internal systems; prioritize and track remediation.Coordinate external penetration testing engagements, manage vendor relationships, and translate findings into actionable remediation plans.Monitor threat intelligence feeds and apply findings to the TRUST environment; communicate relevant risks to engineering leadership.Security Operations and Incident ResponseManage security monitoring and visibility across the environment using Vanta, AWS services (GuardDuty, Security Hub, CloudTrail) and existing tooling: tune alerting, analyze logs, investigate anomalies, and maintain operational visibility across the environment.Implement a future SIEM capability.Develop and maintain incident response runbooks; lead tabletop exercises and manage security incidents from detection through resolution and post-mortem.Design, implement, and monitor security controls across application, network, and cloud layers (AWS).Manage identity and access management (IAM) controls, including privileged access, MFA enforcement, and third-party vendor access policies.Secure Development and Engineering PartnershipPartner with engineering leadership to embed security into the SDLC -- code reviews, threat modeling, and secure development guidelines.Review and assess the security posture of new features, integrations, and infrastructure changes prior to deployment.Support vendor and third-party risk assessments, particularly for offshore development partners and SaaS integrations.Serve as the internal subject matter expert on application security, API security, and OWASP Top 10 for the development teams.What we're looking for:7+ years of experience in cybersecurity engineering or information security roles, ideally within a SaaS or fintech environment.Demonstrated experience owning or leading compliance programs or audits NYDFS, ISO 27001, SOC2, PCI, or equivalent financial services.Strong hands-on experience with cloud security (AWS, Azure, or GCP), including identity, logging, monitoring, and access control.Ability to quickly adapt and operate in an AWS-based environment is expected.Experience securing SaaS platforms or applications, including API security and working with engineering teams in an SDLC environment.Hands-on experience with SIEM platforms, vulnerability scanning tools, and endpoint security solutions.Strong understanding of OWASP Top 10, secure coding practices, and API security.Experience conducting or coordinating penetration tests and translating findings into remediation roadmaps.Excellent written communication skills -- ability to produce policy documentation, audit evidence, and clear security reports for non-technical audiences.Experience working in environments with offshore development teams and managing third-party vendor security risk (preferred).Financial services, insurance, or lending industry background (preferred).CISSP, CISM, CEH, or equivalent security certification (preferred).