This is a remote position.
A note on applications — please read before applying
We use AI tools heavily in our day-to-day engineering, and we expect you to as well. A résumé is different. It is the one artifact where we want your actual voice, your real judgment, and specifics only you can supply.
We do not review AI-generated résumé summaries or profiles. They are generic, interchangeable, and tell us nothing about the person behind them. Applications with an obviously AI-written summary will be rejected outright, without further review. Write it yourself.
Overview
Dealer Alchemist builds the digital advertising platform that powers automotive dealer websites across the country. We run a mature production WordPress platform serving our live dealer sites, alongside a growing cloud-based platform.
We are looking for an early-career engineer who wants to build a career in application and infrastructure security, and who already has real hands-on WordPress and PHP experience. That combination matters here: the most valuable security work on our platform is understanding plugin and theme code well enough to know what is actually exploitable, keeping a large fleet of sites patched and hardened, and closing the gap between a scan finding and a working fix.
This is a growth role with genuine responsibility, not a shadowing role. You will run day-to-day security operations and contribute directly to the platform. You will work under engineering leadership and alongside senior engineers who own risk decisions and lead incident response — you set the pace on the work, they backstop the judgment calls, and your scope expands as you demonstrate it.
How the role splits
Roughly 60% security and 40% platform engineering. The platform work is not filler — it keeps you fluent in the codebase you are securing, and it is where a lot of remediation actually lands. Your security objectives are committed and tracked alongside platform work each sprint, so proactive security does not get crowded out by day-to-day requests.
What You’ll Do
Security
-
Vulnerability management — run scans, interpret results, triage findings by real-world exploitability, and drive remediation to closure with the engineers who own the code.
-
WordPress and dependency security — own the patch cadence for core, plugins, themes, and third-party libraries; identify risky or abandoned dependencies and make the case for replacing them.
-
Apply and maintain hardening baselines across Linux servers, web server configuration, and application settings.
-
Help implement security controls: access reviews, secrets management, security logging and alerting, and TLS / certificate hygiene.
-
Perform security-focused code review on PHP and JavaScript changes, and help triage findings from automated scanning in the pipeline.
-
Participate in incident response — monitoring, triage, evidence gathering, documentation, and the lessons-learned process, working alongside the senior engineers who lead it.
-
Support SOC 2 compliance — evidence collection, control documentation, and policy support.
-
Track vulnerabilities and threats relevant to our stack, and translate them into prioritized, actionable tickets.
Platform Engineering & Operations
-
Write and review PHP and JavaScript for the WordPress platform, with a focus on security fixes, hardening, and remediation work.
-
Diagnose and resolve WordPress, PHP, and MySQL issues alongside the development and support teams.
-
Assist with releases, deployments, and client site launches using internal automation scripts.
-
Administer Ubuntu / Debian Linux servers: patching, monitoring, nginx configuration, log analysis, and routine maintenance.
-
Work with DNS records, domain configuration, and SSL / TLS certificates across client site environments.
-
Build small automations and scripts that reduce manual security and operations overhead.
Requirements
-
1–3 years of professional experience in software development, systems administration, or IT with a demonstrated security focus. Strong internship, lab, home-lab, or CTF work counts toward this.
-
Hands-on WordPress and PHP experience — you can read plugin and theme code, trace a bug through it, and write a fix. This is a hard requirement, not a nice-to-have.
-
Solid security fundamentals: OWASP Top 10, authentication and authorization concepts, encryption and TLS basics, and common web attack vectors.
-
Comfortable on the Linux command line: file system, process management, and log analysis.
-
Scripting ability in Bash and / or Python.
-
A working understanding of web application architecture — HTTP, DNS, TLS, APIs, and how a request actually reaches your code.
-
Working knowledge of MySQL: writing queries and debugging data issues.
-
Strong written communication — security work is documentation-heavy, and clear writing is a core part of the job.
-
Genuine curiosity and a methodical approach. We would rather hire someone who digs until they understand the root cause than someone who already knows every tool.
-
Must reside in the U.S. and be authorized to work without sponsorship.
Nice to Have
-
Security certifications (e.g., CompTIA Security+, eJPT) or active pursuit of one.
-
Hands-on experience with vulnerability scanners (e.g., Nessus, OpenVAS, Trivy, WPScan) or centralized logging / SIEM concepts.
-
Exposure to SOC 2 or another compliance framework.
-
Experience managing nginx: server blocks, proxy configs, rewrites, and SSL.
-
Familiarity with a major cloud platform (e.g., GCP or AWS) and cloud IAM basics.
-
Exposure to containers and container security.
-
CI/CD familiarity (e.g., GitHub Actions) and pipeline security tooling — dependency scanning, SAST, DAST.
-
Any exposure to modern TypeScript-based backend or frontend frameworks.
-
Proficiency using AI-assisted tools in engineering and security workflows, with sound judgment on privacy and data handling.
What Success Looks Like (First 90 Days)
-
A documented inventory of our production surfaces and the known security gaps on each, ranked by actual exposure rather than raw scanner severity.
-
A running vulnerability management cycle — scan, triage, remediate, verify — on a predictable cadence.
-
A consistent patch cadence for WordPress core, plugins, and dependencies across the fleet, with the riskiest gaps closed first.
-
Several security fixes shipped by you, end to end, from finding to verified remediation.
-
Clear documentation of what we run, what protects it, and what still needs attention.
Growth Path
This role is designed to grow. As you build depth, the scope expands toward owning the vulnerability management program outright, leading incident response, and taking on security architecture input for new work. We will support relevant training and certification along the way.
Benefits
Compensation & Benefits
-
Remote — work from anywhere in the U.S.
-
Unlimited PTO — performance-based flexibility
-
401(k) with employer matching
-
Comprehensive healthcare — medical, dental, and vision
-
Paid professional development
-
Salary - $80,000 - $105,000
About Dealer Alchemist
Dealer Alchemist is a digital advertising agency specializing in the automotive industry. We build and operate the platforms that power dealer websites and advertising campaigns at scale, combining deep domain expertise with modern engineering practices.
Skills Required
- 1-3 years of professional experience in software development, systems administration, or IT with a demonstrated security focus; strong internship, lab, home-lab, or CTF work may count
- Hands-on WordPress and PHP experience, including reading plugin and theme code, tracing bugs, and writing fixes
- Knowledge of OWASP Top 10, authentication and authorization, encryption and TLS, and common web attack vectors
- Comfort with the Linux command line, including file systems, process management, and log analysis
- Scripting ability in Bash and/or Python
- Understanding of web application architecture, HTTP, DNS, TLS, APIs, and request flow
- Working knowledge of MySQL, including query writing and data issue debugging
- Strong written communication
- Curiosity and a methodical root-cause analysis approach
- Must reside in the United States and be authorized to work without sponsorship
- Security certification such as CompTIA Security+ or eJPT, or active pursuit of one
- Experience with vulnerability scanners or centralized logging and SIEM concepts
- Exposure to SOC 2 or another compliance framework
- Experience managing nginx server blocks, proxy configurations, rewrites, and SSL
- Familiarity with GCP or AWS and cloud IAM fundamentals
- Exposure to containers and container security
- CI/CD familiarity and pipeline security tools such as dependency scanning, SAST, and DAST
- Exposure to TypeScript-based backend or frontend frameworks
- Proficiency with AI-assisted tools in engineering and security workflows, including privacy and data-handling judgment
What We Do
Dealer Alchemist is a dealer-centric digital advertising agency focused on the automotive industry. It provides dealership clients with technology products spanning websites, search, social, OTT, SEO, and analytics, while its proprietary CORe platform is designed to improve conversion, advertising-spend efficiency, and transparency. The company supports clients through account management and performance-focused marketing services, emphasizing measurable results, customer retention, and long-term relationships.
