Security Engineer

About the role

About Vibes

Vibes’ mobile-first platform creates personal, revenue-driving and long-term mobile engagement between consumers and the world-class brands they love. Industry leaders like Chipotle, Kohl’s and Polo Ralph Lauren use Vibes to grow customer relationships with relevant, high-volume mobile messaging and mobile wallet marketing on a global scale. Vibes enables marketers to seamlessly connect with their customers using a data-rich and API-packed solution that beautifully optimizes and unifies their SMS, MMS, RCS and Mobile Wallet campaigns. To learn more about Vibes, visit www.vibes.com.

Vibes is building a security program that covers the whole company: our cloud environment, our applications, our workforce, and the AI tools and agents we increasingly rely on. As a Security Engineer, you'll build, run, and improve the controls that protect all of these. You'll work hands-on in cloud infrastructure and code, partner closely with engineering, IT Support, and GRC, and help shape how we adopt AI securely and use it to make security work faster.

This is a generalist role with real ownership. You'll do the engineering work and also explain risk and drive remediation across teams. This role will report to the Senior Security Engineer.

What you'll do:

Cloud and infrastructure security

- Engineer, operate, and improve controls that protect our cloud environment, including network, identity, logging, encryption, and configuration baselines

- Improve security tooling coverage so every active project and account reports into a single view, and track and close coverage gaps

- Define guardrails and secure defaults that make the safe path the easy path for engineering teams

Vulnerability management

- Run vulnerability management end to end: ingestion, triage, prioritization by real-world risk, assignment, and closure

- Work with remediation owners to agree on timelines, unblock fixes, and handle exceptions

- Report on SLA performance, backlog age, and risk trends to security leadership

Detection and incident response

- Tune detections to improve signal and reduce noise, and respond to security events as they arise

- Write, maintain, and rehearse incident response runbooks

- Plan and run tabletop exercises, and turn lessons learned into concrete improvements

- Take part in the security on-call rotation [if applicable]

Identity and access management

- Build and improve how access is granted, reviewed, and removed, including group-based access, provisioning automation, and periodic access reviews

- Own the security steps in joiner, mover, and leaver processes, working with GRC and IT Support

- Apply least privilege, role-based access, and SSO consistently across people, service accounts, and agent identities

Secure development and code review

- Review code and infrastructure-as-code changes for security risk before they reach production