Senior Software Engineer, Security Platform

This is a fully remote position, open to applicants in Colombia.

📋 Description

• Design, develop, and manage security engineering services primarily utilizing Golang and Python on AWS and Kubernetes.

• Maintain, enhance, and decommission existing security services.

• Take ownership of the NATS event-driven platform, including contracts, consumers, delivery guarantees, and observability.

• Integrate scanners, the findings system of record, tickets, and metrics.

• Manage security gates for SAST, SCA, secret detection, container scanning, and IaC scanning.

• Choose and optimize scanners, oversee suppression workflows, minimize false positives, and implement enforcement tools.

• Develop CI review agents, automate finding triage and verification, and create remediation aids.

• Automate workflows from triage to remediation, encompassing reproduction context, fix guidance, and routing.

• Engage in threat modeling and secure design reviews.

• Participate in the on-call rotation for the services you own.

• Report directly to the Director of Information Security and collaborate with detection and response, network, and zero-trust engineers.

⛳️ Requirements

• Over 6 years of professional software engineering experience, with a strong focus on backend development.

• Implemented significant changes to a production application in the last 30 days.

• Excellent proficiency in Golang and competent in Python.

• Practical experience in building and managing event-driven or message-based systems, including contracts, idempotent consumers, replay, and back-pressure.

• Proven experience in developing and operating CI/CD pipeline tools; experience with GitLab CI at scale is highly beneficial.

• Solid knowledge of web application security, including the OWASP Top 10 in actual code.

• Experience with SAST, SCA, and secret-scanning tools such as Semgrep, CodeQL, Snyk, Trivy, Grype, and gitleaks.

• Demonstrated experience in AI-forward engineering, utilizing AI tools and building effective agentic workflows.

• Familiarity with AWS and Kubernetes.

• Preferred: background in fintech, payments, BNPL, or consumer lending, particularly with cardholder data or regulated systems.

• Preferred: knowledge of PCI DSS and SOC 2.

• Preferred: experience in software supply-chain integrity, including SBOM pipelines, dependency governance, artifact signing, and provenance.

• Preferred: understanding of policy-as-code and admission control tools such as OPA, Kyverno, and conftest.

• Preferred: experience with bug bounty programs or external vulnerability report triage.

• Preferred: experience in system-level threat modeling.

🏝️ Benefits

• Fully remote position.

• Work from the location where you are most productive.

• Opportunity to engage with AI-assisted engineering and reusable agentic workflows.

• Utilize open-source technologies and the chance to innovate before purchasing.