SRE Security Engineer

Who We Are:
At OPENLANE we make wholesale easy so our customers can be more successful.

We’re a technology company building the world’s most advanced—and uncomplicated—digital marketplace for used vehicles.
We’re a data company helping customers buy and sell smarter with clear, actionable insights they can understand and use.
And we’re an innovation company accelerating the future of wholesale remarketing through curiosity, collaboration, and an entrepreneurial spirit.

Our Values:
Driven Waybuilders. We pursue challenges that inspire us to build, create, and innovate.
Relentless Curiosity. We seek to understand and improve our customers’ experience.
Smart Risk-Taking. We transform risk into progress through data, experience, and intuition.
Fearless Ownership. We deliver what we promise and learn along the way.

We're Looking For
An SRE Security Engineer who takes ownership of security findings from detection through resolution — remediating misconfigurations, vulnerabilities, and access issues across AWS, Azure, GCP, GitHub, Okta, and Active Directory. You will join a new SRE Security Engineering team formed to close the gap between what Security reports and what actually gets fixed: you will work hands-on inside cloud and identity platforms to drive issues to closure, rather than simply tracking tickets.

You Are
Analytical, decisive, accountable, collaborative, security-minded, and action-oriented.

You Bring

- Core knowledge of identity and access management concepts (RBAC/ABAC, least privilege, federation, SSO) across cloud platforms and on-prem directory services.

- Functional expertise interpreting findings from vulnerability scanners and cloud security posture tools, and translating them into prioritized, actionable remediation.

- Technical expertise remediating issues across AWS, Azure, GCP, GitHub, Okta, and Active Directory — including policy and permission tightening, credential rotation/revocation, group and role cleanup, and network/security-group hardening.

- Core SRE fundamentals: Linux/Unix systems administration, networking, and infrastructure-as-code (Terraform or equivalent), enough to diagnose and change the systems being remediated.

- Active, daily use of AI assistants such as Claude, Gemini, and OpenAI/ChatGPT to speed up investigation, triage, and remediation work.

You Own

- End-to-end remediation of security findings sourced from Ox, Upwind, Socket, vulnerability scans, and direct Security team reports, across all major cloud and identity platforms.

- Triage and validation of incoming findings — distinguishing true positives from noise and prioritizing based on risk.

- A rotating on-call responsibility for urgent security alerts requiring same-day action.

- Adherence to SRE's standard change-management process for any remediation that touches production infrastructure, ensuring changes are reviewed and approved before deployment.

- Timely patching of known vulnerabilities and dependency findings across AWS, Azure, GCP, GitHub, Okta, and Active Directory systems.

You Drive
Execution: Close the loop between security detection and resolution, reducing the backlog of unresolved findings and shortening time-to-remediate for critical issues.

Results: Measurably shrink the population of standing security findings across AWS, Azure, GCP, GitHub, Okta, and Active Directory, and reduce recurrence through root-cause fixes rather than one-off patches.

Team: Contribute to remediation playbooks and runbooks as the team matures, and share platform-specific expertise with Security and SRE.
How You'll Use AI in This Role
AI assistants such as Claude, Gemini, and OpenAI/ChatGPT are a standard part of how this team works, not an optional add-on. Expect to use them daily to triage and summarize scan output from Ox and Upwind, draft and review remediation scripts and infrastructure-as-code changes, and speed up root-cause investigation across unfamiliar systems.

Who You Will Work With
Reporting to the SRE Director, this role sits within Site Reliability Engineering and partners daily with the Security team (who surface findings via Ox, Upwind, Socket, and vulnerability reports), fellow SRE platform teams (who review and approve production-impacting changes), Engineering Leadership and their developers (on remediation affecting their applications and services), and the rest of the SRE Security Engineering team.

Where You Work
Your work is performed as a Remote employee, with occasional team alignment meetings as needed.

Must Have's

- 2 to 4 years of experience in SRE, cloud security, security engineering, or a closely related systems/security role.

- Hands-on experience remediating security issues in at least two of: AWS, Azure, GCP, GitHub, Okta, Active Directory.

- Working knowledge of cloud security posture management / vulnerability scanning tools (e.g., Ox, Upwind, Socket, or similar) and the ability to assess and act on their findings.

- Comfort owning an issue from intake through resolution, including coordinating changes with other engineering teams.

- Experience with infrastructure-as-code (e.g., Terraform) and container/orchestration platforms (Docker, Kubernetes/EKS), enough to remediate infrastructure-level findings directly rather than routing them to another team.

- Experience participating in an on-call rotation and responding to production incidents.

Nice to Have's

- Direct experience with Ox, Upwind, or Socket.

- Relevant cloud or identity certifications (AWS, Azure, GCP, Okta) — not required, but a plus.

- Scripting/automation experience (Python, Bash) to remediate findings at scale rather than one-by-one.

- Experience with observability and monitoring tooling (e.g., Grafana, CloudWatch, Prometheus) to spot recurring issues and verify fixes.

What We Offer:

- Competitive pay

- Medical, dental, and vision benefits with employer HSA contributions (US) and FSA options (US)

- Immediately vested 401K (US) or RRSP (Canada) with company match

- Paid Vacation, Personal, and Sick Time

- Paid maternity and paternity leave (US)

- Employer-paid short-term disability, long-term disability, life insurance, and AD&D (US)

- Robust Employee Assistance Program

- Employer paid Leap into Service Day to volunteer

- Tuition Reimbursement for eligible programs

- Opportunities to expand your skill set and share your knowledge across a publicly traded, global organization

- Company culture of internal promotions, diverse career paths, and meaningful advancement

Sound like a match? Apply Now - We can't wait to hear from you!