Security Engineer

Upwind is hiring a Security Engineer to work on our infrastructure, applications, and internal systems. Day to day that means triaging alerts, closing gaps, keeping our security tooling healthy, and automating the parts of the job that don't need a human.

The team is small, so the work is broad. You'll sit between security, engineering, and IT, and you'll own what you pick up through to resolution. Senior engineers are around for the harder calls.

We lean on automation and AI to cover more ground than a team our size normally would. Priorities shift and plenty of process is still unwritten.

What you'll do

• Triage alerts and suspicious activity. Document what you find, escalate when it matters.
• Chase vulnerabilities down with engineering and IT until they're actually fixed.
• Tighten configuration and access across cloud, endpoints, and SaaS.
• Keep security tooling running: integrations, upgrades, alert tuning.
• Script things. Python and APIs, mostly, to kill repetitive work.
• Use AI where it earns its place, for log analysis, code, first drafts of docs. Verify before you act on it.
• Support incident response: evidence collection, investigation, and the follow-up that stops a repeat.
• Write runbooks people actually use.

Requirements

• 3+ years in security, IT, cloud infrastructure, or software engineering. Internships and serious side projects count.
• Working knowledge of networking, operating systems, authentication, permissions, and the common vulnerability classes.
• Hands-on time in AWS, GCP, or Azure.
• Comfortable writing and debugging scripts. Python, Bash, PowerShell, whatever you know.
• You've used AI tools on real technical problems and can explain how you checked the output.
• You can explain a security issue to someone who doesn't work in security.

Nice to have

• SIEM, EDR, or vulnerability management platforms.
• SSO, MFA, identity providers, SaaS admin.
• Git, CI/CD, containers, Kubernetes, IaC.
• Incident investigation experience.
• Automation that connects tools through APIs or MCP servers.