This is a remote position.
A note on applications — please read before applying
We use AI tools heavily in our day-to-day engineering, and we expect you to as well. A résumé is different. It is the one artifact where we want your actual voice, your real judgment, and specifics only you can supply.
We do not review AI-generated résumé summaries or profiles. They are generic, interchangeable, and tell us nothing about the person behind them. Applications with an obviously AI-written summary will be rejected outright, without further review. Write it yourself.
Overview
Dealer Alchemist builds the digital advertising platform that powers automotive dealer websites across the country. We run a mature production WordPress platform serving our live dealer sites, alongside a growing cloud-based platform.
We are looking for an early-career engineer who wants to build a career in application and infrastructure security, and who already has real hands-on WordPress and PHP experience. That combination matters here: the most valuable security work on our platform is understanding plugin and theme code well enough to know what is actually exploitable, keeping a large fleet of sites patched and hardened, and closing the gap between a scan finding and a working fix.
This is a growth role with genuine responsibility, not a shadowing role. You will run day-to-day security operations and contribute directly to the platform. You will work under engineering leadership and alongside senior engineers who own risk decisions and lead incident response — you set the pace on the work, they backstop the judgment calls, and your scope expands as you demonstrate it.
How the role splits
Roughly 60% security and 40% platform engineering. The platform work is not filler — it keeps you fluent in the codebase you are securing, and it is where a lot of remediation actually lands. Your security objectives are committed and tracked alongside platform work each sprint, so proactive security does not get crowded out by day-to-day requests.
What You’ll Do
Security
-
Vulnerability management — run scans, interpret results, triage findings by real-world exploitability, and drive remediation to closure with the engineers who own the code.
-
WordPress and dependency security — own the patch cadence for core, plugins, themes, and third-party libraries; identify risky or abandoned dependencies and make the case for replacing them.
-
Apply and maintain hardening baselines across Linux servers, web server configuration, and application settings.
-
Help implement security controls: access reviews, secrets management, security logging and alerting, and TLS / certificate hygiene.
-
Perform security-focused code review on PHP and JavaScript changes, and help triage findings from automated scanning in the pipeline.
-
Participate in incident response — monitoring, triage, evidence gathering, documentation, and the lessons-learned process, working alongside the senior engineers who lead it.
-
Support SOC 2 compliance — evidence collection, control documentation, and policy support.
-
Track vulnerabilities and threats relevant to our stack, and translate them into prioritized, actionable tickets.
Platform Engineering & Operations
-
Write and review PHP and JavaScript for the WordPress platform, with a focus on security fixes, hardening, and remediation work.
-
Diagnose and resolve WordPress, PHP, and MySQL issues alongside the development and support teams.
-
Assist with releases, deployments, and client site launches using internal automation scripts.
-
Administer Ubuntu / Debian Linux servers: patching, monitoring, nginx configuration, log analysis, and routine maintenance.
-
Work with DNS records, domain configuration, and SSL / TLS certificates across client site environments.
-
Build small automations and scripts that reduce manual security and operations overhead.
Requirements
-
1–3 years of professional experience in software development, systems administration, or IT with a demonstrated security focus. Strong internship, lab, home-lab, or CTF work counts toward this.
-
Hands-on WordPress and PHP experience — you can read plugin and theme code, trace a bug through it, and write a fix. This is a hard requirement, not a nice-to-have.
-
Solid security fundamentals: OWASP Top 10, authentication and authorization concepts, encryption and TLS basics, and common web attack vectors.
-
Comfortable on the Linux command line: file system, process management, and log analysis.
-
Scripting ability in Bash and / or Python.
-
A working understanding of web application architecture — HTTP, DNS, TLS, APIs, and how a request actually reaches your code.
-
Working knowledge of MySQL: writing queries and debugging data issues.
-
Strong written communication — security work is documentation-heavy, and clear writing is a core part of the job.
-
Genuine curiosity and a methodical approach. We would rather hire someone who digs until they understand the root cause than someone who already knows every tool.
-
Must reside in the U.S. and be authorized to work without sponsorship.
Nice to Have
-
Security certifications (e.g., CompTIA Security+, eJPT) or active pursuit of one.
-
Hands-on experience with vulnerability scanners (e.g., Nessus, OpenVAS, Trivy, WPScan) or centralized logging / SIEM concepts.
-
Exposure to SOC 2 or another compliance framework.
-
Experience managing nginx: server blocks, proxy configs, rewrites, and SSL.
-
Familiarity with a major cloud platform (e.g., GCP or AWS) and cloud IAM basics.
-
Exposure to containers and container security.
-
CI/CD familiarity (e.g., GitHub Actions) and pipeline security tooling — dependency scanning, SAST, DAST.
-
Any exposure to modern TypeScript-based backend or frontend frameworks.
-
Proficiency using AI-assisted tools in engineering and security workflows, with sound judgment on privacy and data handling.
What Success Looks Like (First 90 Days)
-
A documented inventory of our production surfaces and the known security gaps on each, ranked by actual exposure rather than raw scanner severity.
-
A running vulnerability management cycle — scan, triage, remediate, verify — on a predictable cadence.
-
A consistent patch cadence for WordPress core, plugins, and dependencies across the fleet, with the riskiest gaps closed first.
-
Several security fixes shipped by you, end to end, from finding to verified remediation.
-
Clear documentation of what we run, what protects it, and what still needs attention.
Growth Path
This role is designed to grow. As you build depth, the scope expands toward owning the vulnerability management program outright, leading incident response, and taking on security architecture input for new work. We will support relevant training and certification along the way.
Benefits
Compensation & Benefits
-
Remote — work from anywhere in the U.S.
-
Unlimited PTO — performance-based flexibility
-
401(k) with employer matching
-
Comprehensive healthcare — medical, dental, and vision
-
Paid professional development
-
Salary - $80,000 - $105,000
About Dealer Alchemist
Dealer Alchemist is a digital advertising agency specializing in the automotive industry. We build and operate the platforms that power dealer websites and advertising campaigns at scale, combining deep domain expertise with modern engineering practices.
Similar Jobs
.png)
What you need to know about the Colorado Tech Scene
Key Facts About Colorado Tech
- Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3
- Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech
- Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook)
- Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures
- Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute
