Senior Product Security & DevSecOps Engineer

Employment Type: Full-time | Experience: 5–8+ years Work Arrangement: Primarily in-office; no work-from-home flexibility Working Hours: U.S. Central Time (evening/night shift in India) About MIRA Labs MIRA Labs is building an AI-powered mortgage technology platform that streamlines lending workflows, document processing, and decision-making for enterprise customers across the U.S. and Canada. We are seeking a hands-on Senior Product Security & DevSecOps Engineer to own security across our applications, cloud infrastructure, CI/CD pipelines, and AI-powered systems. Key Responsibilities - Application & API Security: Secure React and Python/FastAPI applications, conduct code reviews, address vulnerabilities, and implement OWASP-aligned security controls. - DevSecOps & CI/CD: Secure GitHub repositories and Actions workflows, implement automated security scanning, and protect software delivery pipelines. - Cloud Security: Strengthen security across AWS and Azure, including IAM, Kubernetes, containers, networking, and infrastructure configurations. - Identity & Secrets Management: Implement least-privilege access, MFA, credential rotation, and secure secrets management. - Security Monitoring & Incident Response: Investigate security incidents, monitor suspicious activity, perform root-cause analysis, and improve response procedures. - Vulnerability Management: Conduct security assessments, threat modeling, penetration testing coordination, and vulnerability remediation. - AI & LLM Security: Protect AI agents and LLM integrations against prompt injection, data leakage, unauthorized tool execution, and cross-tenant access. - Compliance & Governance: Support SOC 2, ISO 27001, ISO 42001, enterprise security assessments, and security documentation. Required Qualifications - 5–8+ years of experience in Application Security, Product Security, Cloud Security, or DevSecOps. - Hands-on experience securing production SaaS applications and GitHub Actions CI/CD pipelines. - Strong knowledge of AWS, Azure, IAM, OAuth 2.0, OIDC, JWT, RBAC, and secrets management. - Experience with Python code reviews, REST API security, OWASP standards, and vulnerability remediation. - Practical experience with SAST, DAST, SCA, secret scanning, and container security. - Familiarity with Docker, Kubernetes, and infrastructure as code. - Experience in security monitoring, incident response, and cloud log investigations. - Strong problem-solving skills and the ability to work independently with engineering teams. Preferred Qualifications - Experience in fintech, banking, mortgage technology, or regulated SaaS. - Familiarity with Azure Key Vault, HashiCorp Vault, AWS CloudTrail, AKS, and AWS ECS. - Experience with SOC 2, ISO 27001, AI security, and OWASP LLM security guidance. - Certifications such as OSCP, CSSLP, CISSP, AWS Security Specialty, or AZ-500 are a plus. First 90-Day Goals - Assess application, cloud, repository, and CI/CD security. - Identify and prioritize critical risks. - Implement essential security controls and automated scanning. - Strengthen secrets management and privileged access. - Establish monitoring, incident-response procedures, and a measurable remediation roadmap. - Integrate security checks into the software release lifecycle.