Senior Security Engineer

About the role

This senior position is at the heart of a cloud‑native cybersecurity platform used by enterprises and government agencies. You will own application and cloud security, embedding robust controls into products, infrastructure, and delivery pipelines while working closely with engineering, DevOps, and product teams.

Key responsibilities

• Lead application security initiatives: threat modeling, secure design reviews, and hands‑on vulnerability remediation.
• Design and embed secure SDLC practices into CI/CD pipelines, including SAST, DAST, dependency scanning, and secrets detection.
• Build and manage security tooling and policy‑as‑code controls across Terraform/Terragrunt infrastructure pipelines.
• Identify, prioritize, and remediate vulnerabilities across applications, APIs, cloud infrastructure, and third‑party integrations.
• Own AWS and Kubernetes security: IAM design, network security, encryption, logging, and configuration‑drift management.
• Develop detection and response capabilities using CloudTrail, GuardDuty, and Security Hub; lead incident response activities.
• Drive SOC 2 and ISO 27001 compliance programs, including control design, audit coordination, and documentation.
• Support customer trust initiatives by answering security questionnaires and explaining technical controls.
• Mentor and manage an internal Security Engineer responsible for corporate IT, identity, and endpoint security.

Required profile

• Hands‑on security engineer with deep expertise in cloud and application security.
• Experience operating directly within code, infrastructure, and CI/CD pipelines in a fast‑moving environment.
• Proven track record leading security initiatives and mentoring junior engineers.
• Strong collaboration skills with engineering, product, and DevOps teams.

Required skills

• AWS
• Kubernetes
• Terraform or Terragrunt
• CI/CD pipelines
• SAST and DAST tools
• Dependency scanning and secrets detection
• CloudTrail, GuardDuty, Security Hub
• IAM design and network security
• Encryption, logging, configuration‑drift management
• Threat modeling and secure design reviews
• Vulnerability remediation
• SOC 2 compliance
• ISO 27001 compliance