Sr. Security Engineer

Suralink® is the agentic automation platform for accounting professionals and their clients, leading the global charge in AI-driven accounting technology. As the leading AI platform for accounting firms, Suralink serves more than 50% of the top 100 enterprise accounting firms in the United States and has over 800,000 users globally.

Our mission is to empower the people we serve to redefine the meaning of efficiency in the accounting technology industry. Our award-winning SaaS platform was built for CPA firms, providing a simple, secure way to manage audit, tax, and advisory engagements.

Recognized for growth, innovation, and culture, we foster a highly collaborative, remote-first environment where exceptional, motivated professionals can make a meaningful impact. If you're passionate about building relationships and driving growth at a fast-growing SaaS company, we'd love to talk with you

Who we are looking for:

As our Senior Security Engineer, you will own our entire security posture. We are a growing company and we need someone who can plan our security roadmap and execute the technical work to back it up. You will bridge the gap between high-level risk management and hands-on engineering, ensuring our infrastructure, applications, and corporate data remain secure.

Key Responsibilities:

Security Architecture & Planning

• Define the roadmap: Build and maintain our annual security strategy, compliance goals, and risk management frameworks.

• Vendor & tool management: Evaluate, select, and budget for security tooling without over-engineering our stack.

• Compliance & audits: Own or prepare the company for relevant compliance frameworks (e.g., SOC 2 Type II, or GDPR).

• Incident response planning: Create, test, and maintain our Incident Response (IR) and Disaster Recovery (DR) playbooks.

Hands-on Execution & Engineering

• Cloud & infrastructure security: Harden our cloud environments (AWS/GCP), manage IAM policies, and configure network security.

• AppSec & CI/CD: Integrate automated security scanning (SAST/DAST) into our deployment pipelines and conduct code reviews.

• Endpoint & corporate security: Deploy and manage our MDM, MDR solutions, and identity providers.

• Monitoring & triage: Utilize,Set up log aggregation and investigate security alerts and anomalies.

• Vulnerability and patch management programs, including risk-based prioritization

Culture & Enablement

• Security awareness: Run phishing simulations and train a remote workforce on security best practices.