Lead Security Engineer

This is a fully remote position, open to applicants in United States, +1 more country.

📋 Description

• Oversee Duetto's comprehensive security posture encompassing cloud, product, infrastructure, IT, compliance, and customer assurance.

• Direct cloud security initiatives within AWS, focusing on IAM, logging, network security, encryption, Kubernetes and container security, backup posture, and configuration risk management.

• Collaborate with Engineering and DevOps teams to integrate security throughout the SDLC, CI/CD pipelines, and production operations.

• Manage the entire vulnerability management process, including alert triage, posture management, prioritization, remediation tracking, and reporting.

• Act as the primary security incident leader for significant incidents, investigations, escalations, root cause analyses, and executive reporting.

• Conduct incident response and disaster recovery tabletop exercises, coordinate backup testing, and review business continuity plan security.

• Take ownership of SOC 2 Type 2, ISO 27001, and ISO 42001 readiness, as well as NIST CSF maturity tracking.

• Maintain the security risk register, risk treatment plans, security roadmap, and security debt backlog.

• Collaborate with Legal and Privacy teams on DPA, DTIA, DPF, GDPR, SCCs, and subprocessor management.

• Manage customer-facing security assurance, including strategic RFPs, security questionnaires, enterprise security reviews, Trust page content, and sales support calls.

• Provide security guidance to IT regarding MDM, endpoint security, AV/EDR coverage, access reviews, and SaaS security controls.

• Report on security posture, risks, incidents, remediation status, and audit readiness to executive leadership.

⛳️ Requirements

• A minimum of 8 years of experience in security, cloud security, DevSecOps, security engineering, infrastructure security, or security operations.

• Extensive hands-on knowledge of AWS, including cloud architecture risk assessments.

• Experience in securing DevOps environments, CI/CD pipelines, Kubernetes and container ecosystems, cloud IAM, logging, secrets management, and infrastructure-as-code.

• Familiarity with SOC 2 Type 2 audits and the security requirements of ISO 27001, NIST CSF, and GDPR.

• Proven experience in vulnerability management, penetration testing programs, and incident response.

• Ability to convert technical risks into business-level priorities and effectively communicate with Engineering, Legal, Sales, auditors, customers, and executives.

• Practical experience with Snyk, Lacework, Vanta, MDM platforms, endpoint protection, and cloud posture tools.

• Prior end-to-end ownership of SOC 2 Type 2 audit readiness.

• Experience in implementing or supporting ISO 27001 certification processes.

• Experience assisting with enterprise SaaS security reviews and customer trust programs.

• Familiarity with ISO 42001 or AI governance frameworks.

🏝️ Benefits

• Equal opportunity employer dedicated to fostering diversity and an inclusive work environment.

• Remote work opportunities available for candidates in the US and Canada.