Security Engineer

This is a fully remote position, open to applicants in Australia.

📋 Description

• Lead security engineering efforts for the Python/Django/React application, encompassing code reviews, threat modeling, and security design evaluations.

• Take ownership of static analysis, dependency scanning, and secret scanning within CI; prioritize findings for action.

• Oversee penetration testing, internal red team assessments, and third-party evaluations; facilitate remediation processes.

• Collaborate with engineers to establish secure coding standards and furnish practical guidance.

• Enforce Single Sign-On (SSO) and Multi-Factor Authentication (MFA) for internal tools; manage onboarding, offboarding, and access reviews.

• Secure and audit access to the staff platform.

• Work alongside the Platform team to enhance the security of AWS IAM, network architecture, secrets management, and compute/data layers.

• Define and automate security baselines for infrastructure, including container security and CI/CD pipeline integrity.

• Lead secure architecture evaluations for new systems and significant infrastructure modifications.

• Build and sustain detection capabilities across application, cloud, and SaaS environments.

• Manage security incident response processes, which include triage, containment, investigation, communication, and post-incident evaluations.

• Develop operational runbooks and response playbooks.

• Contribute to the SOC2 compliance program through evidence collection, control monitoring, and audit preparedness.

• Conduct security assessments for vendors and customers.

• Communicate security risks and prioritize remediation efforts.

• Maintain security policies and documentation.

• Define the security roadmap and prioritize initiatives based on impact and risk.

• Represent security considerations in architectural decisions.

• Mentor engineers and staff while fostering a security-first culture.

• Report on security posture to leadership and various departments.

• Advise on internal IT and physical security initiatives.

⛳️ Requirements

• 7+ years of experience in engineering.

• 5+ years of hands-on security experience in product security, application security, or a security engineering role.

• Experience in threat hunting, threat intelligence, or red team activities.

• Strong understanding of Python/Django application security.

• Solid experience in AWS cloud security, covering IAM, network controls, and secure architecture models.

• Practical incident response experience, including being on call.

• Proven experience leading a security incident.

• Working knowledge of SOC2 or a similar compliance framework aligned with engineering practices.

• Ability to clearly articulate risks to both technical and non-technical stakeholders.

• Comfortable working independently in a remote, cross-timezone setting.

• Relevant certifications such as OSCP, CISSP, AWS Security Specialty, or similar are advantageous.

🏝️ Benefits

• A competitive salary in a rapidly growing startup.

• Four weeks of paid vacation leave annually.

• Two weeks of paid sick leave each year.

• Paid Parental Leave.

• A company-provided laptop.

• Monthly internet allowance/reimbursement.

• Office setup allowance.

• Annual learning and development budget.

• Flexibility in work style; employees are trusted to determine the best way to work.

• Option to work remotely from home or a co-working space.

• Support from a friendly and engaging international team.