Associate Security Engineer

About the role

SPS Commerce is hiring an Associate Security Engineer to join Agentic Cyber Engineering (ACE), the function that builds and hardens the agentic tooling Cyber Defense, Cyber Security and adjacent engineering teams run: MCP servers, tool integrations, and AI-augmented security workflows. This role brings two capabilities to ACE, hands-on offensive-security skills to red-team agent tooling before it reaches production, and software engineering capacity to build and maintain offensive and other agentic tooling. The ideal candidate finds the ways an agent and software tool's permissions, prompt boundaries, or integrations can be abused, before that abuse happens in production.

Responsibilities

• Build and maintain MCP servers and tool integrations for security-engineering agents, under the Lead Engineer's architecture.
• Contribute to ACE's internal tooling repositories — issues, PRs, documentation.
• Support integration of agent tooling with the existing security stack (CrowdStrike Falcon, Panther, Jira, OSS).
• Apply offensive-security methodology (prompt injection, tool-abuse paths, permission-boundary testing, jailbreak attempts) to agents and MCP servers before they ship.
• Document findings in the same reproduction-steps / business-impact / remediation format used for traditional vulnerability disclosure.
• Partner with the Lead Engineer on remediation and re-verification.
• Write Python/SQL tooling to support ACE workflows — data pipelines, evaluation harnesses, internal dashboards.
• Extend existing automations as ACE's agent fleet grows.
• Produce a technical writeup for every agent evaluation: affected system, reproduction steps, risk severity, recommended fix.
• Keep tooling documentation current enough that another engineer can extend it without hand-holding.

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, or equivalent practical experience.
• Working proficiency in at least one general-purpose language (Python preferred) with real shipped code, coursework alone is not sufficient.
• Hands-on experience with offensive-security tooling (e.g., Burp Suite, Nmap, Metasploit) in an authorized context (CTF, red-team internship, responsible disclosure program).
• Familiarity with SIEM/log analysis concepts.
• Comfortable with Git-based version control and collaborative development.
• Familiarity with core AWS serverless technologies; Lambda, Step Functions, DynamoDB, EC2, and similar, the building blocks of serverless compliance, governance, and security tooling.

Qualifications

• Direct experience with LLM tooling, agent frameworks, or MCP, even personal-project level.
• OSINT / reconnaissance tooling experience (Shodan, Maltego, theHarvester, or peers).
• Prior red-team or C2 infrastructure exposure in an authorized engagement.
• A documented history of responsible vulnerability disclosure.
• Competitive security background (CTF, Cyber Skyline, NCL, or similar).

Pay

The annual salary range for this role is $70,600.00 - $90,000. The actual salary offered will be determined based on factors including education, relevant skills, work history, certifications, location, and more.

Schedule

This role follows a hybrid work model, with regular in-office presence required at our MSP office.