Information Security & Platform Engineer

Dealer Alchemist is a digital advertising agency specializing in the automotive industry. They are looking for an early-career engineer to build a career in application and infrastructure security while managing day-to-day security operations and contributing to the platform engineering efforts.

What you'll do:

• Vulnerability management — run scans, interpret results, triage findings by real-world exploitability, and drive remediation to closure with the engineers who own the code
• WordPress and dependency security — own the patch cadence for core, plugins, themes, and third-party libraries; identify risky or abandoned dependencies and make the case for replacing them
• Apply and maintain hardening baselines across Linux servers, web server configuration, and application settings
• Help implement security controls: access reviews, secrets management, security logging and alerting, and TLS / certificate hygiene
• Perform security-focused code review on PHP and JavaScript changes, and help triage findings from automated scanning in the pipeline
• Participate in incident response — monitoring, triage, evidence gathering, documentation, and the lessons-learned process, working alongside the senior engineers who lead it
• Support SOC 2 compliance — evidence collection, control documentation, and policy support
• Track vulnerabilities and threats relevant to our stack, and translate them into prioritized, actionable tickets
• Write and review PHP and JavaScript for the WordPress platform, with a focus on security fixes, hardening, and remediation work
• Diagnose and resolve WordPress, PHP, and MySQL issues alongside the development and support teams
• Assist with releases, deployments, and client site launches using internal automation scripts
• Administer Ubuntu / Debian Linux servers: patching, monitoring, nginx configuration, log analysis, and routine maintenance

What they're looking for:

• 1–3 years of professional experience in software development, systems administration, or IT with a demonstrated security focus. Strong internship, lab, home-lab, or CTF work counts toward this
• Hands-on WordPress and PHP experience — you can read plugin and theme code, trace a bug through it, and write a fix. This is a hard requirement, not a nice-to-have
• Solid security fundamentals: OWASP Top 10, authentication and authorization concepts, encryption and TLS basics, and common web attack vectors
• Comfortable on the Linux command line: file system, process management, and log analysis
• Scripting ability in Bash and / or Python
• A working understanding of web application architecture — HTTP, DNS, TLS, APIs, and how a request actually reaches your code
• Working knowledge of MySQL: writing queries and debugging data issues
• Strong written communication — security work is documentation-heavy, and clear writing is a core part of the job
• Genuine curiosity and a methodical approach. We would rather hire someone who digs until they understand the root cause than someone who already knows every tool
• Must reside in the U.S. and be authorized to work without sponsorship
• Security certifications (e.g., CompTIA Security+, eJPT) or active pursuit of one
• Hands-on experience with vulnerability scanners (e.g., Nessus, OpenVAS, Trivy, WPScan) or centralized logging / SIEM concepts

Benefits:

• Remote — work from anywhere in the U.S.
• Unlimited PTO — performance-based flexibility
• 401(k) with employer matching
• Comprehensive healthcare — medical, dental, and vision
• Paid professional development