Security Engineer

You will join a new security team during a critical build-out phase, working across application security and infrastructure security. You will review code, harden cloud environments, support incident response, and partner with engineering teams to improve security posture across the company. This is a generalist role suited to an early-team hire where you work across domains rather than specializing in one, growing into deeper expertise as the team and program mature. You will collaborate closely with the security program manager and work directly with engineering teams on secure design, findings, and remediation. You do not need expertise in the full tech stack, but you should be comfortable navigating a mixed environment and learning what you need.

Responsibilities

• Perform application security reviews by conducting code reviews, running SAST/DAST and dependency scanning tools, and working with engineering to resolve findings
• Participate in threat modeling sessions for new features and architecture changes
• Help harden cloud and container infrastructure by working on GCP, Kubernetes, and IAM configurations
• Participate in pen test remediation by triaging findings and working with engineering teams to implement fixes
• Partner with engineering on secure design by reviewing architectures and advising on secure implementation patterns
• Identify and track security findings, assess severity, and track them through the remediation lifecycle
• Support incident response by investigating and documenting security events and contributing to root-cause analysis
• Write async security guidance including advisories and best-practice documentation
• Support product security by working with partners on the security posture of customer-facing services

Requirements

• Understands common vulnerability classes, secure coding patterns, and how to conduct a meaningful code review
• Has worked with GCP or a similar cloud provider and is comfortable with IAM, networking, and container concepts
• Reads and reviews code in one or more of Go, Python, PHP
• Has used or is familiar with SAST, DAST, or dependency scanning tools
• Writes clear, concise async documentation
• Partners effectively with engineering teams
• Eager to learn and comfortable with ambiguity