EverCommerce - Security Engineer

About the role

EverCommerce is a leading service commerce platform, providing vertically-tailored, integrated SaaS solutions that help more than 745,000 global service-based businesses accelerate growth, streamline operations, and increase retention. Its modern digital and mobile applications create predictable, informed, and convenient experiences between customers and their service professionals. With its EverPro, EverHealth, and EverWell brands specializing in Home, Health, and Wellness service industries, EverCommerce provides end-to-end business management software, embedded payment acceptance, marketing technology, and customer experience applications.

Responsibilities

• Create and maintain security architecture and engineering processes and procedures.
• Design system architectures that meet established cybersecurity requirements and align with customer needs, including security requirements definition, documentation, and communication.
• Develop security architecture requirements and implementation guidance based on analysis of NIST 800-53 and/or other security control frameworks.
• Architect, design, implement, maintain, and operate information system security controls and countermeasures.
• Provide techniques and patterns for securing integration with external security system vendors and/or cloud providers.
• Lead regular architecture and design reviews to ensure requirements implementation.
• Evaluate and play an active role in the life-cycle management of multiple security technologies.
• Identify security risks and control gaps within systems, designs, products, data flows, and processes; recommend corrective architecture, integrations, controls, and operations.
• Participate in the development of security requirements, architectures, and documentation to ensure security controls are seamlessly integrated into new technology deployments.
• Perform secure architecture and design reviews of new technology and security systems deployments, and collaborate with business teams to integrate secure-by-design principles into CI/CD pipelines and Agile development processes.
• Maintain a clear view of the overall security architecture roadmap and strategic plan.
• Leverage emerging technologies and advanced security practices to ensure EverCommerce is at the forefront of security for its solution groups and customers.
• Build, maintain, and mature security architecture metrics and reporting.
• Serve as a subject matter expert/contributor measurably improving the overall security framework and program.
• Mentor junior security engineers and analysts.
• Perform additional duties as required and assigned.

Requirements

• At least 5 years of relevant work experience in a technical field (e.g., cybersecurity, software development, or systems administration).
• Bachelor’s degree in a technical discipline such as Cyber Security, Information Technology, Computer Science, or Information Systems—or equivalent professional experience.
• At least one current industry-recognized security certification: CISSP, CISM, CISA, GIAC, or commensurate experience.
• Excellent communication and interpersonal skills, with the ability to collaborate effectively with cross-functional teams, matrixed organizations, and technical and non-technical stakeholders.
• Demonstrated experience with the security, development, and/or management of systems compliant to NIST 800-53, NIST CSF, or ISO 27001:2022 security control frameworks.
• Exceptional knowledge and understanding of the creation, implementation, and securing of cloud technologies such as AWS and Azure.
• Knowledge of information security risk assessment methodologies and standards.
• Highly flexible, self-motivated, and eager to learn, with a strong passion for cybersecurity.
• Excellent verbal and written English communication skills.

Preferred Qualifications

• Advanced knowledge regarding common attacks, attack methods, and defense architectures.
• Experience in securing multi-tenant compute services, microservices, and modern APIs.
• Working knowledge of common web and container-based vulnerabilities.
• Experience with information security policies and procedure development and implementation.
• Experience developing technical documentation, including reports, proposals, statements of work, and whitepapers.

This role is distributed globally, with teams in the U.S., Canada, the U.K., Jordan, New Zealand, and Australia. The position can be based anywhere in the United States (Denver, CO is preferred). Remote work is supported, and occasional travel to corporate headquarters in Denver, Colorado, or other North American office locations may be required. Candidates must be eligible to work without sponsorship.

Benefits and Perks

• Continued investment in professional development.
• Day 1 access to a robust health and wellness benefits package, including an annual wellness stipend.
• 401k with up to a 4% match and immediate vesting.
• Flexible and generous (FTO) time-off.
• Employee Stock Purchase Program.

Compensation

The target base compensation for this position is $130,000 to $150,000 USD per year, plus an annual bonus opportunity in most U.S. locations. Final offer amounts are determined by multiple factors including location, local market variances, and candidate experience and expertise, and may vary from the amounts listed above.