At Mechanical Orchard, we specialize in safely rewriting the most critical and complex business applications—the software that runs the world as we know it today—so they’re ready to adapt quickly and easily to market challenges and opportunities. Our approach emerged from observing the decades-long failure patterns in modernization efforts and is designed to eliminate the risks and disruptions that characterize most projects.
Our background in software development and the impact on the industry is well known: we've literally helped write the book on XP and other impactful Agile practices. We’re applying the same thoughtfulness and rigor in applying AI pragmatically where it helps. We believe in the durable principles behind Agile, and embrace the power of cross-functional teams, collective ownership, test driven development, short feedback loops, and continuous improvement.
We’re bringing joy to beleaguered IT teams everywhere. Together, we’re seeing how applying craft, expertise, and technologies we’re building can fundamentally transform the way companies operate, innovate, and win. Our values are: Do the right thing. Do what works. Be kind.
We’re looking for an Information Security / Application Security Engineer who can bridge the gap between security and software development. You’ll work closely with our engineering teams to integrate security into the software development lifecycle (SDLC), improve secrets management, implement security automation, and help scale our security posture as we pursue SOC 2, ISO 27001, and FedRAMP compliance.
Responsibilities
- Secure Software Development & Engineering Support: Partner with software teams to embed security into the SDLC (design reviews, threat modeling, dependency management). Review architecture, code, and CI/CD configurations for security concerns. Assist developers in implementing secure authentication, authorization, and secrets management practices. Build or integrate tooling to automate static analysis, dependency scanning, and container security checks.
- Security Controls & Automation: Design and roll out software development security controls (e.g., centralized secrets management, secure build pipelines). Automate security evidence collection and reporting for compliance frameworks. Collaborate with development teams to mitigate findings from CSPM tooling. Collaborate with the IT and Infrastructure teams on endpoint hardening, identity, and access control.
- Incident Readiness & Risk Management: Contribute to vulnerability management and security incident response. Support risk assessments for engineering projects, new technologies, vendors, and deployments. Participate in post-incident reviews and drive security improvements.
Required Qualifications
- 3+ years of professional software engineering experience (Python, Go, Java, or similar).
- Familiarity with modern DevOps and cloud environments (especially GCP).
- Solid understanding of application security fundamentals — authentication, encryption, secrets management, input validation, and secure APIs.
- Experience with CI/CD systems (GitHub Actions, GitLab CI, etc.) and integrating security tooling.
- Ability to work collaboratively with engineers — balancing pragmatism and security.
Preferred Qualifications
- Experience with or exposure to security compliance frameworks (SOC 2, ISO 27001, FedRAMP).
- Hands-on experience with secrets management, SAST, DAST, container scanning, or policy management security tooling like HashiCorp Vault, Snyk, Trivy, or Open Policy Agent.
- Experience in cloud-native environments (Kubernetes, Terraform, Infrastructure-as-Code security).
- Certifications such as CSSLP, GCSA, or OSWE are a plus.
