Security Engineer
Bright Machines is a San Francisco technology manufacturer that uses robotics, physical AI, simulation, and production data to build AI and data-center infrastructure.
About Bright Machines
Bright Machines operates the Bright Factory manufacturing platform, combining virtual product development, AI-enabled robotic assembly and inspection, and factory intelligence to produce complex AI infrastructure with traceability and scalable edge deployment.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will execute day-to-day information security operations across corporate IT, platform, and product environments. You will maintain ISO 27001:2022 certification, coordinate customer security due diligence, support secure software development, manage vulnerabilities, help respond to incidents, govern access, assess vendor risks, and report security posture and compliance status.
Requirements
- 5+ years of experience in security engineering, IT security, application security, or a closely related role
- Experience maintaining an ISO 27001 ISMS
- Knowledge of application security fundamentals, OWASP Top 10, and secure SDLC practices
- Hands-on experience with SAST, DAST, and SCA tooling
- Proficiency in a scripting language such as Python
- Infrastructure-as-code experience with tools such as Terraform or Ansible
- Familiarity with GRC platforms
- Basic cloud security knowledge across AWS, Azure, or GCP
- Experience completing customer security questionnaires and supporting customer-facing security conversations
- Familiarity with EDR/managed SOC platforms and security operations workflows
- Excellent written and verbal English communication skills
Responsibilities
- Execute day-to-day information security operations across corporate IT, platform, and product environments
- Maintain ISO 27001:2022 certification through evidence collection, internal audits, corrective actions, and audit support
- Complete customer security questionnaires, support customer audits, and track contractual security requirements
- Partner on threat modeling, secure code review guidance, and SAST, DAST, and SCA tooling
- Run vulnerability scanning, triage findings, and drive remediation to SLA
- Coordinate third-party penetration tests and track findings to closure
- Support security incident response plans, investigations, and tabletop exercises
- Support identity and access governance, including access reviews, certifications, and MFA/SSO enforcement
- Conduct security risk assessments for vendors, tools, and third-party integrations
- Maintain security policies, standards, and employee awareness training
- Track and report security posture, risk, and compliance status
