Senior Product Security & Dev Sec Ops Engineer

About MIRA Labs

MIRA Labs is building an AI\-powered mortgage technology platform that streamlines lending workflows, document processing, and decision\-making for enterprise customers across the U.S. and Canada.

We are seeking a hands\-on **Senior Product Security \& DevSecOps Engineer** to own security across our applications, cloud infrastructure, CI/CD pipelines, and AI\-powered systems.Key Responsibilities

• **Application \& API Security:** Secure React and Python/FastAPI applications, conduct code reviews, address vulnerabilities, and implement OWASP\-aligned security controls.
• **DevSecOps \& CI/CD:** Secure GitHub repositories and Actions workflows, implement automated security scanning, and protect software delivery pipelines.
• **Cloud Security:** Strengthen security across AWS and Azure, including IAM, Kubernetes, containers, networking, and infrastructure configurations.
• **Identity \& Secrets Management:** Implement least\-privilege access, MFA, credential rotation, and secure secrets management.
• **Security Monitoring \& Incident Response:** Investigate security incidents, monitor suspicious activity, perform root\-cause analysis, and improve response procedures.
• **Vulnerability Management:** Conduct security assessments, threat modeling, penetration testing coordination, and vulnerability remediation.
• **AI \& LLM Security:** Protect AI agents and LLM integrations against prompt injection, data leakage, unauthorized tool execution, and cross\-tenant access.
• **Compliance \& Governance:** Support SOC 2, ISO 27001, ISO 42001, enterprise security assessments, and security documentation.

Required Qualifications

• 5–8\+ years of experience in Application Security, Product Security, Cloud Security, or DevSecOps.
• Hands\-on experience securing production SaaS applications and GitHub Actions CI/CD pipelines.
• Strong knowledge of AWS, Azure, IAM, OAuth 2\.0, OIDC, JWT, RBAC, and secrets management.
• Experience with Python code reviews, REST API security, OWASP standards, and vulnerability remediation.
• Practical experience with SAST, DAST, SCA, secret scanning, and container security.
• Familiarity with Docker, Kubernetes, and infrastructure as code.
• Experience in security monitoring, incident response, and cloud log investigations.
• Strong problem\-solving skills and the ability to work independently with engineering teams.

Preferred Qualifications

• Experience in fintech, banking, mortgage technology, or regulated SaaS.
• Familiarity with Azure Key Vault, HashiCorp Vault, AWS CloudTrail, AKS, and AWS ECS.
• Experience with SOC 2, ISO 27001, AI security, and OWASP LLM security guidance.
• Certifications such as OSCP, CSSLP, CISSP, AWS Security Specialty, or AZ\-500 are a plus.

First 90\-Day Goals

• Assess application, cloud, repository, and CI/CD security.
• Identify and prioritize critical risks.
• Implement essential security controls and automated scanning.
• Strengthen secrets management and privileged access.
• Establish monitoring, incident\-response procedures, and a measurable remediation roadmap.
• Integrate security checks into the software release lifecycle.

Benefits

• Leave encashment
• Paid time off
• Provident Fund

Work Location: In person