IcyBox
Senior Security Engineer
- Location
- New York City, United States
- Work type
- On-site · Full-time
- Salary
- USD 180,000 – 220,000 / year
- Posted
- (10 hours ago)
About the role
Our Mission
Everyone knows the feeling of opening something unexpected and loving it. IcyBox turns that feeling into a business. We started as a watch commerce and mystery box company and are building a consumer brand people trust and come back to. We move fast, sweat the details, and are still writing our playbook.
Our Values
Move Fast, Build Right: Ship today, fix tomorrow.
Own the Gap: If nobody owns it, we step in.
Clarity Is a Gift: Turn noise into decisions and action.
Trust Over Title: Follow-through beats position.
Say the Real Thing: Hard conversations happen early.
Do the Unglamorous Work: No task is beneath us.
About the Role
We’re hiring a Senior Security Engineer to protect IcyBox, our customers and their data. You’ll own security across our apps, cloud infrastructure and internal systems, and help the team build securely without slowing down. This role is in person at our New York City office, five days a week.
What You’ll Do
Find and fix vulnerabilities across our mobile, web, and backend apps
Secure our AWS environment, including access management, networking and secrets
Run threat modeling and security reviews for new features
Build security checks into CI/CD, such as code scanning and dependency checks
Lead incident detection and response, including logging, alerting and playbooks
Follow security news and disseminate relevant information to the team
Prevent account takeover, bots and abuse on our site and app
Manage penetration tests, bug bounty reports and vendor security reviews
Support compliance work such as PCI DSS and privacy laws
Train engineers on secure coding
What We’re Looking For
5+ years in security engineering, application security or cloud security
Hands-on experience securing AWS environments
Strong understanding of web and mobile application security, including the OWASP Top 10
Able to read and write code in at least one language, such as Rust, Python, Go or TypeScript
Experience leading incident response
Able to explain risk clearly and give engineers practical fixes
Nice to Have
Experience working with production Rust, React, and React Native systems
E-commerce or payments security experience, including PCI DSS
Fraud, bot and account takeover prevention
SIEM tools and detection engineering
Certifications such as OSCP, CISSP or AWS Certified Security – Specialty
First security hire or early security team experience at a startup