SaaS Senior Engineer, Information Security, Architecture and Engineering - Technology Solutions[...]

WHERE YOU’LL FIT WITHIN THE TEAM

The SaaS security engineer will lead and scale our SaaS security program, with primary ownership of our SaaS security posture management (SSPM) platform and related initiatives. The role is technical, and candidates must possess a solid understanding of information security, cloud infrastructure, and SaaS application configuration practices. The role also requires an understanding of business goals/strategy and operational requirements in a fast‑paced environment, and the ability to communicate clearly and effectively both business risk impacts and the technical actions required to resolve them. The SaaS security engineer supports the growing third‑party ecosystem, working to reduce misconfiguration risk, improve identity hygiene, and strengthen monitoring and governance recommendations across a variety of cloud-based applications. They are an integrated team member working with product owners, application administrators, system engineers, cybersecurity engineers, and systems administrators. At times they act as a liaison with business stakeholders to understand strategy and execution outlook. The role is heavily security‑focused and ingrained in the third‑party application lifecycle to deliver security principles and validation at all times. Essential Functions Technical work (40%) Own and operate the SaaS Security Posture Management (SSPM) platform Onboard new SaaS applications into SSPM and define security baselines Design and implement secure configuration standards for enterprise SaaS platforms (M365, Salesforce, ServiceNow, Slack, etc.) Develop and maintain SaaS security configuration benchmarks Improve identity and access controls across SaaS applications (RBAC, MFA, SSO enforcement) Integrate SSPM findings into SIEM/SOAR platforms Develop detection logic for anomalous SaaS behavior Build dashboards and reporting to track SaaS posture and risk trends Automate security checks and remediation workflows via APIs and scripting Enhance SaaS monitoring and logging coverage Serve as a point of contact for security‑based escalations and remain tightly involved through resolution Assist in third‑party technical reviews and solution advisement, identifying gaps in existing controls and recommending solutions to vendors Partner with Senior Manager and stakeholders to problem‑solve Support team growth and improvement (30%) Establish scalable SaaS security review processes for new application onboarding Contribute to development of SaaS security standards and governance frameworks Improve joiner/mover/leaver access governance processes Identify tooling gaps and recommend new security capabilities Create documentation and playbooks for SaaS security operations Mentor junior security engineers or IT administrators on SaaS security best practices Drive continuous improvement initiatives to reduce manual security effort Track and report on SaaS security KPIs to inform program maturity Vulnerability and Misconfiguration handling (20%) Monitor, triage, and remediate SaaS misconfigurations identified by SSPM, automating and documenting to scale to operations Identify excessive permissions, risky OAuth grants, and policy drift Partner with application owners to drive timely remediation of high‑risk findings Perform periodic access reviews and privilege audits Reduce stale accounts, toxic permission combinations, and overprivileged roles Support SaaS‑related security incidents and root‑cause analysis Act as an escalation point for technical teams to get support in resolving vulnerabilities and misconfigurations Communicate results in a manner understood by technical and non‑technical business units based on risk tolerance and threat to the business, and gain support through influential messaging Maintain strong third‑party awareness via database sources, documentation, etc., to understand the weakness, probability and remediation options supplied by vendors as well as workarounds Communications and Leadership (10%) Partner with IT, Engineering, Legal, Procurement, and Risk teams to improve SaaS security posture Provide clear reporting on SaaS risk exposure and remediation progress Support SaaS security discussions in vendor risk and audit engagements Lead security conversations with application owners and executive stakeholders as needed Advocate for secure‑by‑default SaaS configurations across the organization About You Hybrid: This role follows a hybrid model, requiring in‑office presence at least 1 day per week. Required Undergraduate or similar level of relevant work experience 3‑7+ years of business and/or security experience Breadth of analytical, technical and project and time‑management skills Understanding of SaaS security risks and misconfigurations Understanding of OAuth and API security Understanding of SSO, MFA, RBAC, and common IdPs Preferred CISSP, GIAC, Security+, or other relevant coursework and certifications 3‑5 years of enterprise SaaS administration experience (M365, Salesforce, Slack, etc.) Understanding of IT environments and practices related to one or more of the following disciplines Networking Infrastructure configuration and resiliency System architecture and configuration Operating systems Application development Operational/IoT technology Cloud Operations U.S. Compensation Information Compensation for this role includes base salary, annual discretionary performance bonus, 401(k) plan with an annual employer contribution based on years of service, and Bain’s best‑in‑class benefits package. In Boston, MA, the good‑faith, reasonable annualized full‑time salary range for this role is between $108,250 and $130,000; placement within this range will vary based on several factors including, but not limited to experience, education, licensure/certifications, training and skill level In Chicago, IL, the good‑faith, reasonable annualized full‑time salary range for this role is between $103,500 and $124,250; placement within this range will vary based on several factors including, but not limited to experience, education, licensure/certifications, training and skill level Annual discretionary performance bonus This role may also be eligible for other elements of discretionary compensation 4.5% 401(k) company contribution, which increases after 3 years of service and is 100% vested upon start date Benefits Bain pays 100% individual employee premiums for medical, dental and vision programs Generous paid time off, including parental leave, sick leave and paid holidays Fully vested 401(k) company contribution Paid Life and Long‑Term Disability insurance Annual fitness reimbursements It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability. #J-18808-Ljbffr Tech Economy