Apply
Description
Do you see threats where others see business as usual, and love turning that instinct into real defenses? Do you read a CrowdStrike detection, a GuardDuty finding, and a vulnerability scan report and already know which one matters most? Have you made AI a real part of how you do security? We mean a tool you use every day to triage faster, cut noise, and spend your time on the work only a human can do, not a buzzword on your resume. If so, read on…
RTA is looking for a Senior Security Engineer to protect every layer of our tech stack and culture. Our Fleet360 platform is a multi-tenant SaaS on AWS. Hundreds of fleets rely on it, including cities, counties, school districts, transit agencies, and public safety organizations. Those customers expect government-grade security, and we're building toward it.
You'll report to the Director, Support Engineering and work alongside our Cloud, Systems, and Database Engineers, partnering with teams across the company to keep our customers' fleets, and our reputation, safe.
This isn't a "watch the dashboard and forward the alert" role. You'll be a hands-on security engineer who identifies risks, builds practical solutions, and helps strengthen RTA's security posture. One day you might be improving an incident response process, and the next building an AI-assisted triage workflow or advancing our compliance readiness.
This role is not for everyone. If you prefer clearly defined tasks handed to you one at a time, this may not be your seat. We're looking for someone who sees an undefined security problem, takes ownership, and brings a thoughtful plan to solve it.
Your Top 3 Objectives & Measures of Success
- Strengthen RTA's Security Posture
Proactively identify, prioritize, and remediate security risks across our AWS infrastructure, endpoints, applications, and identity systems. Build sustainable security practices that reduce exposure and improve our ability to detect and respond to threats.
Measures of Success:
- Critical and High vulnerabilities are identified, prioritized, and tracked through resolution.
- Critical vulnerabilities are remediated within 7 days and High vulnerabilities within 30 days, or have documented, approved risk exceptions.
- Security incidents are promptly escalated, appropriately contained, and documented with clear root cause analysis and follow-up actions.
- Cloud, endpoint, and identity security configurations are regularly reviewed and improved, with measurable progress against established security baselines.
- Drive Compliance and Audit Readiness
Maintain RTA's SOC 2 Type II readiness while advancing our GovRAMP/FedRAMP security roadmap. Partner across the organization to implement controls, manage risks, and maintain the documentation and evidence needed to demonstrate compliance.
Measures of Success:
- Assigned SOC 2 controls are maintained, tested, and supported by current, accurate evidence.
- Within the first 90 days, complete a security gap assessment and establish a prioritized GovRAMP/FedRAMP readiness roadmap with leadership.
- Compliance gaps, risks, and remediation activities are documented, assigned, and tracked against agreed-upon timelines.
- Annual audit activities are completed on schedule, with minimal last-minute evidence collection or avoidable findings.
- Scale Security Through AI and Automation
Use AI and automation to improve the speed, consistency, and effectiveness of security operations while ensuring the tools and workflows themselves are secure.
Measures of Success:
- Within the first 6 months, implement at least two production-ready security automations that reduce manual effort or improve detection, investigation, or remediation.
- Demonstrate measurable improvements in efficiency through reduced manual processing, faster triage, or improved workflow consistency.
- Establish appropriate guardrails for AI-enabled security workflows, including data handling, access controls, and human oversight.
- Identify and continuously improve opportunities to integrate security into existing engineering and business processes.
What You'll Actually Own Protect & Detect
- Run and tune CrowdStrike Falcon, AWS GuardDuty, CloudTrail, and our managed SOC/MDR pipeline.
- Monitor detections, sensor health, prevention policies, and escalations, partnering with our 24x7 managed security provider to investigate and resolve threats.
- Improve detection quality and reduce unnecessary alerts through tuning and automation.
Hunt & Fix
- Own the vulnerability management process across cloud, endpoint, and applicable on-premises assets.
- Manage Qualys or equivalent scanning, risk-based prioritization, remediation tracking, and verification.
- Coordinate with Engineering and IT teams responsible for implementing fixes, and document approved exceptions in the Risk Register.
- Coordinate Patch Tuesday reviews and annual external penetration testing.
Automate & Integrate
- Integrate Snyk or similar SAST, DAST, SCA, and container security scanning into GitHub Actions and development workflows.
- Partner with developers to identify and address security issues before deployment.
- Build practical AI-assisted workflows for alert triage, scan analysis, remediation guidance, and evidence collection.
- Champion security as code and repeatable, scalable processes.
Comply & Certify
- Coordinate the technical security activities supporting RTA's annual SOC 2 Type II audit.
- Advance GovRAMP/FedRAMP readiness through NIST SP 800-53 controls mapping, gap remediation, evidence management, and POA&M tracking.
- Partner with control owners and leadership to maintain audit readiness throughout the year.
Respond & Recover
- Coordinate security incident response activities, including investigation, containment, recovery, root cause analysis, and documentation.
- Work with the managed SOC/MDR provider and internal stakeholders to ensure clear escalation and accountability.
- Maintain and test incident response plans and participate in tabletop exercises.
Govern & Guide
- Develop and maintain practical security policies, procedures, and playbooks.
- Strengthen identity and access security across Microsoft Entra ID SSO, Cloudflare Zero Trust, Auth0, and least-privilege IAM.
- Maintain an actionable security Risk Register and communicate material risks and recommendations to leadership.
- Help establish appropriate security guardrails for company AI adoption, including data protection, vendor risk, and prompt injection awareness.
Support Our Customers & Teams
- Lead technical security responses for customer questionnaires, RFPs, HECVAT assessments, and vendor due-diligence requests.
- Support security awareness initiatives, including monthly training and employee education.
- Serve as a security subject matter expert and mentor to technical teams, sharing best practices and helping build security knowledge and capabilities across the organization.
- Partner with Product, Engineering, Support, and other departments to make security a shared responsibility.
- Translate complex security risks into clear, actionable recommendations for technical and nontechnical audiences.
What We're Looking For
In general, someone who:
- Is a service-minded protector who measures success by how secure, and how empowered, others feel.
- Has truly adopted AI into how they work. You use AI tools to improve productivity, automate repetitive work, and solve problems while understanding where human judgment and security safeguards matter most.
- Is comfortable with healthy conflict and constructive feedback. You can challenge ideas respectfully, welcome different perspectives, and work toward the best outcome for the team.
- Is Humble, Hungry, and Smart. Patrick Lencioni fans earn bonus points.
- Passionately cares about our clients. They are fleet managers, parts clerks, and technicians maintaining everything from squad cars to school buses, so everyone comes home safely at the end of the day.
- Takes ownership and initiative. You surface problems before you're asked and bring a plan with them.
- Believes no job is beneath them. If something needs doing, you roll up your sleeves and help.
Specifically for This Job, Someone Who:
- Has 5+ years of experience in security engineering, cloud security, or a closely related field.
- Has a proven track record securing AWS workloads, including VPCs, Security Groups, IAM, GuardDuty, CloudTrail, KMS, and Secrets Manager.
- Has hands-on experience with EDR platforms (CrowdStrike preferred), vulnerability management (Qualys or similar), SIEM/MDR operations, and application security scanning (Snyk or similar).
- Understands modern DevOps and CI/CD security practices, including GitHub Actions and automated security testing.
- Has working knowledge of SOC 2 Type II and NIST SP 800-53. GovRAMP or FedRAMP experience is a strong plus.
- Has practical experience using AI tools to improve security or technical workflows, with sound judgment about data protection and risk.
- Can write scripts using Python, PowerShell, or Bash to automate security processes.
- Understands identity and access management, least-privilege principles, and modern Zero Trust practices.
- Can independently manage projects, prioritize competing security risks, and coordinate work across teams.
- Communicates clearly and confidently with engineers, executives, auditors, and customers.
Bonus Points (Preferred Certifications & Skills)
- Certifications such as CISSP, CISM, CCSP, OSCP, Security+, AWS Security Specialty, or other AWS certifications.
- Experience with CJIS, public-sector security requirements, or regulated environments such as PCI or HIPAA.
- Experience with Terraform/CloudFormation, Cloudflare Zero Trust, Microsoft Entra ID, or Kubernetes RBAC.
- Experience securing AI/LLM integrations or building AI-powered security automation, including agentic workflows and MCP-connected tools.
The Bottom Line We want an ideal team player with an almost frightening intensity around customer service, a passion for protecting others, and the technical ability to make security stronger, smarter, and more scalable. You'll have the opportunity to make a meaningful impact on RTA's security posture, help advance our compliance journey, and define what AI-augmented security engineering looks like in a growing SaaS company. If you're ready to keep RTA's mission rolling safely, and have some fun doing it, we'd love to hear from you! Total compensation for the role is competitive and depends on experience. This is a full-time, fully remote U.S. role, with occasional travel to our Glendale, Arizona headquarters for team gatherings and other business needs.
Compensation & Work Location
- The anticipated salary range for this role is $160,000–$185,000 annually, depending on experience, skills, and qualifications.
- This is a full-time, fully remote-eligible role for candidates located in the United States.
- Occasional visits to RTA HQ in Glendale, Arizona for team meetings and events should be expected.
- Travel is expected to be minimal, generally up to 10% based on business needs.
- This position is classified as exempt and is not eligible for overtime pay.
Why Top Talent Chooses RTA We invest in our people - period.
- 401(k) with 6% Safe Harbor match (100% vested day one)
- Flexible PTO model built on trust and manager-approved time off
- Cigna PPO and HSA medical plan options with company contributions ($780–$1,950 annually)
- Garner Health HRA program: up to $1,000 individual / $2,000 family reimbursement opportunity
- Wellness rewards up to $350 annually
- Virtual care and mental health support resources
- Company-sponsored benefits including dental, vision, EAP, life, STD, LTD, legal plan, and identity theft protection options
- Additional employee perks, wellness initiatives, and discount programs
The Part We're Most Proud Of
- #34 on the Fortune Best Small Workplaces™ 2026 list
- 99% of employees say RTA is a Great Place to Work® - Certified three years running
- 30% ARR growth - two years straight
- We're an AI-forward company building for the future
- Meaningful work supporting the fleets and people who keep communities running
- Big growth. Real benefits. Strong culture. A team that delivers.
About Us
Founded in 1979, RTA has long earned the reputation of knowing our stuff and providing the best customer service in the market. Our purpose is simple: help fleets succeed. We pride ourselves on creating a caring, family-oriented atmosphere for both staff and clients, and we love that our work has a positive impact on the lives we touch. Our clients carry kids in school buses, first responders in emergency vehicles, patients in ambulances, food and medical supplies in trucks, and people just taking the bus or train to work. We do meaningful work, and we want our clients to have the best tools available to them.
Physical & Travel Requirements
This role has the following physical and travel requirements:
- Ability to sit or stand for extended periods.
- Ability to work at a computer for prolonged periods.
- Ability to communicate effectively through video, phone, messaging, and other remote collaboration tools.
- Occasional travel to RTA's corporate headquarters in Glendale, Arizona and/or other company or team gatherings based on business needs.
Reasonable Accommodation RTA is committed to providing reasonable accommodations for qualified individuals with disabilities. If you need a reasonable accommodation to complete the application process or perform the essential functions of this role, please notify us at hr@rtafleet.com.
Employment Notices Employment with RTA is at-will. This means either the employee or the company may terminate the employment relationship at any time, with or without cause or notice, subject to applicable law.
Employment with RTA may be contingent upon successful completion of a background check and other pre-employment screenings, consistent with applicable law.
Applicants must be legally authorized to work in the United States. RTA is unable to provide employment visa sponsorship at this time.
Equal Employment Opportunity RTA is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other protected status under applicable law.
Notice of AI Use in Job Application Review As part of our commitment to creating a fair, efficient, and consistent hiring process, we may use artificial intelligence (AI) to help our recruiting teams organize, summarize, and analyze information provided by candidates, including resumes, application responses, and other materials submitted during the application process.
AI may be used to identify patterns, highlight relevant skills and experience, and assist in comparing a candidate's qualifications with the requirements of a specific role. These tools are used to improve efficiency and consistency while supporting more informed hiring decisions, which will ultimately be made by the hiring team.
Salary Description
$160k - $185k annually, DOE
Notice of AI Use in Job Application Review As part of our commitment in creating a fair, efficient, and consistent hiring process we may use artificial intelligence (AI) to help our recruiting teams organize, summarize, and analyze information provided by candidates, including resumes, application responses, and other materials submitted during the application process.AI may be used to identify patterns, highlight relevant skills, and experience, and assist in comparing a candidate’s qualifications with the requirement of a specific role. These tools are to improve efficiency and consistency while supporting more informed hiring decisions, which will ultimately be made by the hiring team.