Senior Cyber Security Engineer / DevSecOps

About the role

ABOUT THE ROLE

This Senior Cyber Security Engineer / DevSecOps role is a highly collaborative position designed for a security professional who can seamlessly bridge the gap between offensive exploitation and defensive engineering. Instead of sitting in a silo, you will be deeply embedded within the product, engineering, and infrastructure teams to champion security architecture from the ground up.

WHAT YOU'LL DO

• Work closely with the product and engineering teams to review new features and suggest new features that improve security.

• Drive S-SDLC in our cycles and review security acceptance criteria and threat modeling.

• Guide and train the team to cover security checks and security best practices.

• Perform pre-deployment and post-deployment security penetration tests.

• Plan and execute regular web, mobile, and cloud security assessments and pen tests.

• Work closely with the Infrastructure teams to identify security issues through red teaming activities.

• Define, implement, and monitor infrastructure security measures.

• Contribute to the security roadmap & backlog.

• Assess security tools and integrate tools as needed.

• Incident Response & Research.

• Follow new security news, trends, tools, and incidents and drive needed changes.

• Support in managing our Bug-bounty program and security channels.

• Conduct vulnerability research against company assets.

• Work on understanding and improving our security logging and monitoring solutions.

• Coordinate company-wide response to security incidents till remediation.

• Vulnerability management for production/staging environments.

• Actively mentor members of the security team.

WHAT YOU'LL NEED

• Bachelor's degree in Computer Science, Software Engineering, or a related field (or equivalent work experience).

• Minimum 5 years of experience performing application and/or infrastructure penetration testing experience above and beyond running automated tools.

• Highly experienced in performing security code reviews; Python experience is a plus.

• Solid understanding of cloud platforms (AWS, Azure, or GCP) and containerization technologies (Docker, Kubernetes), serverless / lambda as a plus.

• Solid understanding of software development principles, software testing methodologies, and version control systems (e.g., Git).

• Hands-on experience implementing security policies in various environments (servers, storage, networks, security, virtualization, systems monitoring, and management).

• Strong communication skills and the ability to effectively articulate technical concepts to technical and non-technical stakeholders.

• Solid understanding of networks and network security (experience in Fortinet is a plus).