Security Engineer II

WHO WE ARE

Act Blue is a nonprofit organization dedicated to creating cutting-edge technology that fuels Democratic victories and enables progressive causes to thrive.

Our vision is simple: building change through the power of people. Since our founding, we’ve been building innovative solutions to revolutionize grassroots fundraising – if you’ve donated to a Democratic campaign or a progressive organization online, you’ve probably used our platform! We believe in putting power in the hands of small-dollar donors by helping thousands of groups — from local candidates to national movements — mobilize their communities and create a lasting impact.

Every member of our team is deeply committed to advancing our shared mission and core values. Together, we are shaping the future of democracy.

The Security Team at Act Blue works to protect Act Blue from threat actors that might target Act Blue Technical Services (ATS), our donors, or the campaigns and organizations that fundraise on our platform. Our security program is anchored in empathy for our stakeholders, which is a primary value for our team.

Security Engineers work in concert with product engineering, platform, and operations engineers within engineering to perform security reviews early in their engineering process. The Security Engineer II will perform offensively-focused ad hoc security reviews, vulnerability assessments, respond to incidents, and detect threats across our tech stack.

• Partner closely with engineers to perform security reviews that support our software and infrastructure engineers early in their engineering process
• Perform vulnerability assessments and offensively-focused ad hoc security reviews to identify and prioritize potential security risks and vulnerabilities
• Participate in incident response activities, including investigation, containment, and recovery efforts
• Implement, iterate and operate security automation aimed at supporting our engineers during their building processes, reducing the time it takes to remediate discovered vulnerabilities, and improving our team’s ability to address potential incidents

• Can perform reviews that demonstrate deep domain expertise in one or more core security domains and secondary specializations, (e.g. infrastructure security, application security, corporate IT security, security operations)
• Has experience performing practical information security attacks utilizing popular attacker tools during offensive security reviews,
• Can continuously readily learn and apply lessons learned from new attacks/attackers to your area of focus
• Can proactively utilizes our SIEM/SOAR tooling to inform work and decisions
• Can be a primary SME for our on-call rotation for at least one area of expertise or responsibility
• Can deploy, manage, monitor, and/or provide sustainable operational support for a subset of technology that our team relies on to enforce security requirements and detect threat actors to defend Actblue
• Experience with OWASP principles
• Understanding of modern TTPs used to target B2C online business
• Experience deploying tools that make it easier for engineers to build safely
• Experience and passion for hunting for vulnerabilities and driving remediations
• Proficiency in Ruby, JavaScript, and/or Python

• Dev stack:
  Ruby on Rails, React, Postgre
  
  SQL, Node.js, Redis
• Infra stack:
  Heroku, Amazon Web Services, K8s
• Business Systems:
  Gsuite, Okta, Github, Atlassian, Netsuite, Hubspot

This posting is for a full-time, remote, salaried position. Travel may be required on a limited basis to attend all-staff and departmental retreats (1-2 times per year). Additional travel may be required for select positions.

Arizona, California, Colorado, Connecticut, Florida, Georgia, Hawaii, Illinois, Maryland, Massachusetts, Michigan, Minnesota, Missouri, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Texas, Utah, Vermont, Virginia, Washington, Wisconsin, and Washington D.C.

While Act Blue is currently registered to support remote work in the states…