Senior Security Engineer

Our Mission

Everyone knows the feeling of opening something unexpected and loving it. IcyBox turns that feeling into a business. We started as a watch commerce and mystery box company and are building a consumer brand people trust and come back to. We move fast, sweat the details, and are still writing our playbook.

Our Values

• Move Fast, Build Right: Ship today, fix tomorrow.

• Own the Gap: If nobody owns it, we step in.

• Clarity Is a Gift: Turn noise into decisions and action.

• Trust Over Title: Follow-through beats position.

• Say the Real Thing: Hard conversations happen early.

• Do the Unglamorous Work: No task is beneath us.

About the Role

We’re hiring a Senior Security Engineer to protect IcyBox, our customers and their data. You’ll own security across our apps, cloud infrastructure and internal systems, and help the team build securely without slowing down. This role is in person at our New York City office, five days a week.

What You’ll Do

• Find and fix vulnerabilities across our mobile, web, and backend apps

• Secure our AWS environment, including access management, networking and secrets

• Run threat modeling and security reviews for new features

• Build security checks into CI/CD, such as code scanning and dependency checks

• Lead incident detection and response, including logging, alerting and playbooks

• Follow security news and disseminate relevant information to the team

• Prevent account takeover, bots and abuse on our site and app

• Manage penetration tests, bug bounty reports and vendor security reviews

• Support compliance work such as PCI DSS and privacy laws

• Train engineers on secure coding

What We’re Looking For

• 5+ years in security engineering, application security or cloud security

• Hands-on experience securing AWS environments

• Strong understanding of web and mobile application security, including the OWASP Top 10

• Able to read and write code in at least one language, such as Rust, Python, Go or TypeScript

• Experience leading incident response

• Able to explain risk clearly and give engineers practical fixes

Nice to Have

• Experience working with production Rust, React, and React Native systems

• E-commerce or payments security experience, including PCI DSS

• Fraud, bot and account takeover prevention

• SIEM tools and detection engineering

• Certifications such as OSCP, CISSP or AWS Certified Security – Specialty

• First security hire or early security team experience at a startup