{"schemaVersion":"jobsearcher.job.v1","id":"4658f487fab1e663e4dce5d2","url":"https://jobsearcher.com/jobs/4658f487fab1e663e4dce5d2","canonicalUrl":"https://jobsearcher.com/jobs/4658f487fab1e663e4dce5d2","title":"Security engineering - application","description":"Founding Security Engineer | Series B Dev Infrastructure Company | Remote \rThis one's different: you'd be employee #1 in security at a fast-growing, well-funded Series B developer infrastructure company whose product sits at the heart of the software supply chain for some of the most demanding engineering orgs in the world — think quant trading firms, AI-native companies, and platform teams who don't tolerate sloppy tooling. \r\rThere's a blank whiteboard, real budget, and a CEO who treats security as core to the product — not a compliance checkbox bolted on after the fact. \r\rStanding up detection and response from scratch — SIEM or outsourced SOC, your call, then own it \rHardening AWS (IAM, GuardDuty, Security Hub, SCPs) and Cloudflare (WAF, Zero Trust, DLP) hands-on — not writing recommendations for someone else to implement \rWriting and enforcing security scanning directly into Infrastructure as Code — Terraform is the backbone here, and you'll be embedding tools like Checkov/tfsec into CI/CD so bad config never ships in the first place, not just catching it after deploy \rBringing order to endpoint security across a Mac-heavy dev fleet and production infrastructure \rOwning software supply chain security end-to-end — SBOMs, SLSA, dependency scanning, remediation — for a product where that's literally the customer value prop \rGetting genuinely hands-on with application security : integrating SAST/SCA tooling (think Semgrep, Snyk, GitHub Advanced Security) straight into developer workflows, sitting in on design reviews and threat modeling for new features, and working shoulder-to-shoulder with engineers to actually fix vulnerabilities using a risk-based model — not generating an aging report and hoping someone reads it \rTalking directly to enterprise customers about security posture — this product runs in serious, security-conscious environments, and you'll be the credible technical voice in those conversations \rYou've got 5+ years of hands-on security engineering, ideally at a software or cloud-native company — bonus points if that company was small enough that you built something instead of maintaining it \rYou've got real application security chops — you can read code, you understand common vulnerability classes, and you've partnered with developers on fixes rather than just flagging findings and moving on \rYou've got hands-on Infrastructure as Code experience — Terraform specifically — and you know how to build security into the pipeline itself, not just audit what's already deployed \rYou know AWS security cold and have real Cloudflare experience (or the aptitude to pick it up fast)\rYou understand software supply chain security — SBOMs, artifact signing, dependency risk — as more than buzzwords","company":"Staffing Science","rawCompany":"staffing science","city":"Remote","state":"OR","isRemote":true,"isActive":false,"createdAt":"2026-11-01T11:23:11.728Z","occupations":[{"code":"15-1299.05","title":"Information Security Engineers","slug":"information-security-engineers"},{"code":"15-1252.00","title":"Software Developers","slug":"software-developers"},{"code":"15-1299.08","title":"Computer Systems Engineers/Architects","slug":"computer-systems-engineers-architects"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"541511","title":"Custom Computer Programming Services","slug":"custom-computer-programming-services"},{"code":"513210","title":"Software Publishers","slug":"software-publishers"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"Security engineering - application","description":"Founding Security Engineer | Series B Dev Infrastructure Company | Remote \rThis one's different: you'd be employee #1 in security at a fast-growing, well-funded Series B developer infrastructure company whose product sits at the heart of the software supply chain for some of the most demanding engineering orgs in the world — think quant trading firms, AI-native companies, and platform teams who don't tolerate sloppy tooling. \r\rThere's a blank whiteboard, real budget, and a CEO who treats security as core to the product — not a compliance checkbox bolted on after the fact. \r\rStanding up detection and response from scratch — SIEM or outsourced SOC, your call, then own it \rHardening AWS (IAM, GuardDuty, Security Hub, SCPs) and Cloudflare (WAF, Zero Trust, DLP) hands-on — not writing recommendations for someone else to implement \rWriting and enforcing security scanning directly into Infrastructure as Code — Terraform is the backbone here, and you'll be embedding tools like Checkov/tfsec into CI/CD so bad config never ships in the first place, not just catching it after deploy \rBringing order to endpoint security across a Mac-heavy dev fleet and production infrastructure \rOwning software supply chain security end-to-end — SBOMs, SLSA, dependency scanning, remediation — for a product where that's literally the customer value prop \rGetting genuinely hands-on with application security : integrating SAST/SCA tooling (think Semgrep, Snyk, GitHub Advanced Security) straight into developer workflows, sitting in on design reviews and threat modeling for new features, and working shoulder-to-shoulder with engineers to actually fix vulnerabilities using a risk-based model — not generating an aging report and hoping someone reads it \rTalking directly to enterprise customers about security posture — this product runs in serious, security-conscious environments, and you'll be the credible technical voice in those conversations \rYou've got 5+ years of hands-on security engineering, ideally at a software or cloud-native company — bonus points if that company was small enough that you built something instead of maintaining it \rYou've got real application security chops — you can read code, you understand common vulnerability classes, and you've partnered with developers on fixes rather than just flagging findings and moving on \rYou've got hands-on Infrastructure as Code experience — Terraform specifically — and you know how to build security into the pipeline itself, not just audit what's already deployed \rYou know AWS security cold and have real Cloudflare experience (or the aptitude to pick it up fast)\rYou understand software supply chain security — SBOMs, artifact signing, dependency risk — as more than buzzwords","datePosted":"2026-11-01T11:23:11.728Z","dateModified":"2026-11-01T11:23:11.728Z","hiringOrganization":{"@type":"Organization","name":"Staffing Science","sameAs":"https://jobsearcher.com"},"jobLocationType":"TELECOMMUTE","applicantLocationRequirements":{"@type":"Country","name":"US"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote","addressRegion":"OR","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"4658f487fab1e663e4dce5d2"},"url":"https://jobsearcher.com/jobs/4658f487fab1e663e4dce5d2"}}