InfoSec Engineer

Hello, let us introduce ourselves! watchTowr is the Preemptive Exposure Management capability trusted by Fortune 500 companies and critical infrastructure providers. By combining proactive threat intelligence, real attacker telemetry, and automated red teaming, watchTowr continuously identifies and validates real exposure - so security teams can outrun real-world threats. When exploitation happens in hours, watchTowr delivers what no one else can: time to respond. We are a global team of operators, researchers, and engineers who have spent years thinking like attackers - and we are now building the technology to stop them. Our work is recognised across the industry, with original vulnerability research from watchTowr Labs and innovations like Instinct and Attacker Eye shaping the future of cybersecurity. Backed by $29M in funding, recognised by Gartner, and scaling fast across the globe, we are in a high-growth phase of our journey. We are a young, high-energy, and research-driven team, obsessed with building world-class technology - and we want exceptional people to join us.

But what’s the role? We are looking for an ambitious and hands-on InfoSec Engineer to join us to manage and continuously evolve watchTowr’s internal cyber security capability. The role will be responsible for safeguarding the organization’s information assets, ensuring compliance with industry regulations and internal policies, and supporting the secure management of internal IT systems. This role requires a balance of technical security expertise, compliance awareness, and hands-on IT administration skills.

Sounds great – what will I do? The role will focus on three main areas:

• Information Security

• Cloud Security Architecture (AWS): Design, implement, and maintain secure architectures within our AWS environment to protect against evolving threats.
• Vulnerability Assessment and Management: Conduct regular internal vulnerability scans, analyze results, and coordinate remediation to improve overall security posture.
• Implementation of Security Controls: Deploy and manage security controls across infrastructure, servers, and endpoints (laptops), ensuring both compliance and proactive defense.
• Security Architecture in the Cloud: Continuously evaluate and strengthen cloud security, ensuring scalability, resilience, and compliance with best practices.
• Automation and Scripting: Develop scripts and tools (Python, PowerShell, etc.) to automate repetitive security tasks and improve operational efficiency.

• Compliance Programmes: Support and maintain alignment with ISO 27001 and SOC 2 Type 2 frameworks, contributing to audits, documentation, and evidence collection.
• Security Awareness: Develop, deliver, and assess security awareness training to ensure staff understand and follow security best practices.
• Policy and Process Maintenance: Assist in reviewing and updating security policies, standards, and processes to ensure ongoing compliance.

• Endpoint Management: Oversee deployment, configuration, patching, and security of all endpoints, including servers and laptops.
• Identity and Access Management: Administer and secure user identities through Azure Active Directory, including role-based access control, MFA, and SSO.
• MDM Administration: Manage InTune and mobile device management solutions to enforce secure configurations and compliance across devices.

Sounds perfect to me, what specifics are you looking for?

Core Skills

• 5+ years of professional experience in cybersecurity, with exposure to IT administration in a startup or lean environment.
• Proven expertise in cloud security (AWS), including architecture and controls.
• Hands-on experience with endpoint security solutions and best practices.
• Proficiency in vulnerability management, including assessment and remediation.
• Experience managing Azure AD and MDM platforms.
• Strong automation and scripting skills (Python, PowerShell, or similar).
• Experience delivering security awareness training and assessments.
• Ability to operate independently in a resource-constrained environment (hands-on, no team to delegate to).

Advantages

• Experience in incident response, including planning, execution, and post-incident review.
• Relevant certifications (e.g., CISSP, CISM, AWS Security Specialty, Azure Security Engineer Associate, ISO 27001 Lead Implementer).
• Familiarity with DevSecOps and security integration in CI/CD pipelines.
• Exposure to regulated industries (finance, healthcare, etc.).

What’s in it for me?

• Competitive compensation - we believe that hard work, skills and ambition should be fairly compensated.
• Meaningful role in a company - You will be a key and early contributor to a fast-growing cybersecurity business that helps protect some of the world's largest enterprises.
• The best tools and powerful kit - we enable you with the tools to effectively fulfil your role.
• Endless opportunities – we are in a high-growth phase of our journey, and plan to promote from within as we scale.
• Work with cyber security experts – we are solving cutting-edge industry-wide cyber security challenges with some of the world’s most advanced organisations.

watchTowr is proud to be an Equal Opportunity Employer. At watchTowr, we’re dedicated to fostering an inclusive, respectful, and diverse environment where every individual is recognised for their talent and potential. Our hiring decisions are guided by your capabilities, experience, and what you bring to the role - not by unrelated personal attributes. We have a zero-tolerance approach to any form of discrimination or harassment. This includes - but isn’t limited to - discrimination based on race, ethnicity, religion, colour, nationality, sex, sexual orientation, gender identity or expression, age, disability, pregnancy or parental status, veteran status, or any other characteristic protected by law. We actively encourage people from all backgrounds to apply. Even if you don’t tick every box in the job description, we’d still love to hear from you.