Senior Security Engineer / Security Owner (Hands-on)

About PeopleForce

PeopleForce is an all-in-one HR platform that helps companies manage the entire employee lifecycle, streamline HR processes, and create better employee experiences.

As we grow, protecting our product, customer data, and internal systems becomes increasingly important. Security is not just about meeting compliance requirements — it is about reducing business risks, maintaining customer trust, and enabling our product and engineering teams to build and scale safely.

Why This Role Matters

We are looking for a Senior Security Engineer / Security Owner to become our first dedicated security hire and take hands-on ownership of security across PeopleForce.

Today, we need someone who can assess where our most significant security risks lie, determine what needs to be addressed first, and personally drive the implementation of practical solutions. We are not looking for someone who only defines policies, manages frameworks, or delegates technical work to other teams.
You will work closely with our VP of Engineering, engineers, leadership, Legal, and external security providers to build a security foundation that fits our product, technical environment, and business priorities.

This role combines technical ownership with strategic prioritisation. You will have the autonomy to make decisions, influence engineering practices, and build security processes from the ground up — while staying close to the actual implementation.

Your goal is to build a practical, risk-driven security foundation for PeopleForce — identifying what matters most, implementing effective solutions, and helping the business grow securely without unnecessary complexity.

What You’ll Be Responsible For

1. Identify and Reduce Real Security Risks

• Assess security risks across our product, cloud infrastructure, engineering workflows, customer data, and internal systems.
• Identify the most critical gaps and prioritise them based on business impact, exploitability, and remediation effort.
• Turn security assessments, penetration test results, vulnerabilities, and customer requirements into clear, actionable engineering tasks.
• Track remediation through to completion and verify that implemented controls work as intended.
• Build and maintain a practical security roadmap aligned with business priorities.

2. Make Product and Application Security Part of Engineering

• Integrate security into the software development lifecycle (SDLC), application architecture, code reviews, and CI/CD pipelines.
• Review APIs, authentication, authorisation, and other security-critical product components.
• Implement and improve security tooling, including SAST, DAST, dependency scanning, secrets detection, and Infrastructure as Code scanning.
• Introduce threat modelling and security reviews where they provide meaningful risk reduction.
• Work directly with engineers to resolve vulnerabilities and prevent recurring security issues without creating unnecessary friction in development.

3. Secure Cloud Infrastructure and Access

• Improve the security of our cloud environment, preferably GCP, including infrastructure configuration, logging, monitoring, and access controls.
• Strengthen IAM, privileged access, secrets management, and identity security.
• Improve security across CI/CD, Infrastructure as Code, and containerised environments.
• Review endpoint and internal system security, including SSO, MFA, EDR, MDM, and Google Workspace.
• Help establish appropriate controls for customer data protection, third-party access, and vendor security.

4. Build Practical Security Operations and Incident Readiness

• Develop and maintain practical vulnerability management and security risk management processes.
• Establish incident response procedures and ensure we are prepared to respond effectively to security incidents.
• Coordinate incident response with Engineering, leadership, and external security providers when needed.
• Own relationships with external providers supporting security monitoring, penetration testing, vulnerability assessments, and incident response.
• Evaluate external findings critically, determine which actions are necessary, and ensure that agreed improvements are implemented.

5. Support Customer Trust and Business Growth

• Support enterprise customer security reviews, questionnaires, and security calls.
• Help translate customer security expectations into appropriate technical controls.
• Support compliance readiness and security requirements relevant to enterprise customers, including ISO 27001 where applicable.
• Communicate security risks, priorities, trade-offs, and progress clearly to leadership and other stakeholders.

What We’re Looking For

• 5+ years of relevant experience in Security Engineering, Application Security, Cloud Security, DevSecOps, or a similar technical security role.
• Strong hands-on experience in product and application security, including APIs, authentication, authorisation, secure SDLC, and vulnerability management.
• Solid understanding of cloud security, preferably in GCP environments.
• Practical experience with IAM, CI/CD, secrets management, logging, Infrastructure as Code, and containerised environments.
• Experience selecting, implementing, and configuring security tools such as SAST, DAST, dependency, secrets, and IaC scanning solutions.
• Experience assessing security controls, implementing improvements, and driving remediation through to completion.
• Understanding of security risk management, incident response coordination, and incident readiness.
• Familiarity with endpoint, identity, and access security, including SSO, MFA, EDR, MDM, and Google Workspace.
• Understanding of security controls relevant to enterprise customers and frameworks such as ISO 27001.
• Experience working with external security providers, penetration testing, and vulnerability assessment partners.
• Ability to translate technical findings and business requirements into a prioritised engineering backlog.
• Strong collaboration and influencing skills, with the ability to work directly with engineers and drive technical changes.
• Ability to explain security risks, technical trade-offs, and priorities to both technical and non-technical stakeholders.
• Upper-intermediate English or higher.

How You Work

You will thrive in this role if you:

• Are hands-on by default. You can investigate problems, configure tools, implement controls, and make infrastructure or application security improvements yourself.
• Understand business context. You can distinguish between theoretical risks and issues that genuinely matter to the business, product, and customers.
• Know how to prioritise. You focus on meaningful risk reduction rather than implementing every possible control or framework.
• Take end-to-end ownership. You do not stop at identifying a problem or recommending a solution — you help make sure it gets resolved.
• Work pragmatically. You know how to balance security, engineering speed, complexity, and available resources.
• Can influence without relying on authority. You build trust with engineers, explain the reasoning behind security decisions, and help teams adopt effective practices.
• Are comfortable with ambiguity. As our first security hire, you will shape the approach, establish processes, and make decisions in an evolving environment.

This is a senior individual contributor role with broad ownership and direct access to leadership. You will be expected to lead security through technical expertise, sound judgement, and implementation — not through people management alone.

What We Offer

• 100% remote work with a flexible schedule, Monday–Friday.
• 20 paid vacation days and 10 sick days.
• Health insurance after the probation period.
• High ownership and a direct impact on PeopleForce’s security.
• The opportunity to build a security function from the ground up in an international SaaS company.
• Direct collaboration with Engineering leadership and the opportunity to influence technical decisions.
• A regular English-speaking environment and open communication across teams.

Ready to Make an Impact?

If you enjoy solving real security problems, implementing practical solutions, and building security practices that support business growth, we would love to meet you.
Join PeopleForce and help us build a secure, scalable foundation for our product and customers.