Staff Security Engineer – Product, Cloud

This is a fully remote position, open to applicants in Australia.

📋 Description

• Establish the direction, standards, tools, and practices for product security at UpGuard.

• Conduct security assessments across product and production environments.

• Oversee vulnerability management and execute detection and response operations within cloud-native infrastructures.

• Work closely with product engineering and platform teams to enhance security for products, CI/CD pipelines, and production systems.

• Update threat modeling and security reviews to be integral components of the software delivery process.

• Assess and develop effective AI-driven application security tools for code review, triage, and coverage.

• Strengthen GCP and Kubernetes baselines and implement secure-by-default infrastructure-as-code configurations.

• Lead threat modeling and security evaluations across the product portfolio and cloud infrastructure.

• Create automation, policy-as-code, and AI-driven security tools to integrate security throughout the SDLC.

• Design and execute secure-by-default configurations for cloud and Kubernetes environments.

• Manage the entire vulnerability lifecycle, including risk-based triage, prioritization, remediation, and preventive software supply chain controls.

• Develop scalable detection and response systems and manage incidents from start to finish.

• Forge partnerships with product engineering and platform teams to provide secure-by-design solutions.

• Outline the security roadmap, promote best practices, and enhance UpGuard’s security posture.

⛳️ Requirements

• Over 7 years of experience in security engineering, software engineering, and/or security operations.

• Proficiency in cloud environments.

• Experience in cloud security; GCP is preferred, with AWS or Azure also being acceptable.

• Familiarity with cloud-native Kubernetes services such as EKS, GKE, or AKS.

• Solid understanding of container security principles.

• Comprehensive knowledge of IAM and cloud identities.

• Proven experience leading technical security evaluations of products and architectures.

• Experience conducting threat modeling exercises and translating results into actionable security controls.

• Strong grasp of common web application vulnerabilities, including the OWASP Top 10.

• Practical experience with infrastructure as code, ideally Terraform or OpenTofu.

• Experience as a primary security hire or founding member of a security function is a plus.

• Familiarity with AI/LLM security risks, such as the OWASP LLM Top 10, is advantageous.

• Strong backend engineering capabilities, particularly in Go, are beneficial.

• Experience supporting SOC 2 or ISO 27001 audits is a plus.

• Engagement in public security research, CVEs, open-source security tools, or conference presentations is advantageous.

• Offensive security skills and practical exploitation experience are advantageous.

• Capability to pass a national police history check and reference checks.

• Valid Australian work authorization without the need for company visa sponsorship.

🏝️ Benefits

• Work-from-home setup allowance.

• Monthly lifestyle subsidy for financial, physical, and mental well-being.

• Annual Learning & Development allowance of $1500 USD.

• Annual leave/PTO plus two additional UpGuardian leave days.

• 18 weeks of paid parental leave.

• Personal leave allowance including sick and carer’s leave.

• Fully remote working environment with no mandatory office attendance.

• Provision of a top-spec laptop.

• Paid subscriptions for generative AI tools.

• Stock options.