Staff Security Engineer – Product, Cloud

This is a fully remote position, open to applicants in Australia.

📋 Description

• Establish the vision, standards, tools, and methodologies for product security at UpGuard

• Conduct security assessments across product and production settings

• Oversee vulnerabilities and execute detection and response operations within cloud-native infrastructures

• Partner with product engineering and platform teams to ensure the security of products, CI/CD pipelines, and production systems

• Update threat modeling and security reviews to be integral components of the software delivery lifecycle

• Assess and develop effective AI-driven application security tools for code review, triage, and coverage

• Strengthen GCP and Kubernetes baselines while implementing secure-by-default infrastructure-as-code configurations

• Direct threat modeling and security evaluations across the product range and cloud infrastructure

• Create automation, policy-as-code, and AI-driven security tools to integrate security throughout the SDLC

• Design and implement secure-by-default configurations for cloud and Kubernetes environments

• Manage vulnerability processes end-to-end, including risk-based triage, prioritization, remediation, and preventative software-supply-chain controls

• Develop scalable detection and response systems and manage incidents comprehensively

• Forge partnerships with product engineering and platform teams to provide secure-by-design solutions

• Outline the security roadmap, promote best practices, and enhance UpGuard’s security posture

⛳️ Requirements

• Over 7 years of experience in security engineering, software engineering, or security operations

• Background in cloud environments

• Experience in cloud security; GCP preferred, with AWS or Azure also considered

• Proficient with cloud-native Kubernetes services such as EKS, GKE, or AKS

• Solid understanding of container security principles

• In-depth knowledge of IAM and cloud identity management

• Proven experience leading technical security assessments of products and architectures

• Experience conducting threat modeling exercises and translating insights into actionable security controls

• Strong familiarity with common web application vulnerabilities, including the OWASP Top 10

• Practical experience with infrastructure as code, ideally using Terraform or OpenTofu

• Background as a first security hire or a founding member of a security function is advantageous

• Awareness of AI/LLM security risks, such as the OWASP LLM Top 10, is a plus

• Strong backend engineering capabilities, especially in Go, are beneficial

• Experience in supporting SOC 2 or ISO 27001 audits is an advantage

• Contributions to public security research, CVEs, open-source security tools, or conference presentations are a plus

• Offensive security skills and hands-on exploitation experience are beneficial

• Ability to pass a national police history check and reference assessments

• Authorization to work in Australia without the need for company visa sponsorship

🏝️ Benefits

• WFH setup allowance

• Monthly lifestyle subsidy for financial, physical, and mental wellness

• Annual Learning & Development allowance of $1500 USD

• Annual leave/PTO in addition to two extra UpGuardian leave days

• 18 weeks of paid parental leave

• Personal leave allowance, including sick and carer's leave

• Fully remote working environment with no compulsory office attendance

• High-spec laptop provided

• Paid subscriptions for generative AI tools

• Stock options