Security Software Engineer, Runna

• 3+ years in a Security Engineering role or similar
• 2+ years working with cloud infrastructure (preferably AWS) or as a platform engineer
• You’ve led the development and implementation of key security projects
• Experience with security frameworks, policies, and compliance standards (e.g., SOC 2, GDPR, ISO 27001)
• Familiarity with penetration testing, vulnerability assessments, and incident response gained through practical experience
• Experience with securing cloud infrastructure, ideally within AWS (e.g., VPC, IAM, Security Groups, CloudTrail, GuardDuty)
• Experience with encryption, key management, and identity and access management (IAM)
• Hands-on experience with infrastructure as code tools (e.g., CloudFormation, Terraform) and CI/CD pipelines
• Experience with security monitoring and observability tools (e.g., AWS CloudWatch, Aikido, Datadog)
• A pragmatic mindset, with excellent communication and collaboration skills
• Able to work within a highly-skilled engineering team in a fast-paced, iterative environment

Desirable

• We are looking for a talented, creative, and proactive Security Engineer to join our highly skilled cross-functional engineering team and take ownership of security across the entire organisation
• As the first security engineer, you’ll lead efforts to ensure our cloud infrastructure, applications, and internal processes meet the highest security standards
• You’ll work closely with the engineering, product, and leadership teams to establish a strong security culture while also ensuring compliance with relevant regulations
• You will partner with our CTO and founders to shape the future of security at Runna and play a critical role in safeguarding our product as we scale
• As our first dedicated security hire, you’ll have the freedom and support to build a security roadmap from the ground up
• Lead the effort to secure our cloud infrastructure, ensuring secure deployments, access controls, and robust incident response strategies
• Establish security monitoring and alerting to detect, respond to, and mitigate potential threats in real-time
• Own and drive compliance initiatives (such as GDPR, Cyber essentials) to ensure our organisation meets the required standards
• Implement and enforce best practices for encryption, identity and access management (IAM), and network security across the platform
• Partner with product, engineering, and business teams to ensure security is embedded in all stages of development and product lifecycle
• Create and manage a bug bounty program to incentivise external researchers to identify and report security vulnerabilities
• Educate and train the wider team on security best practices, fostering a security-first mindset across the organisation
• Stay ahead of emerging threats and technologies, ensuring we adopt the latest tools and practices to maintain a secure environment
• Collaborate with external security firms for audits, penetration testing, and other assessments to validate our security posture

• Our aim is to keep the interview process as straightforward and enjoyable as possible, and will consist of the following stages:
• Kick off! (apply below)
• Introductory chat (30-minute video call)
• 1-hour technical interview
• Once the process is finished, we promise to let you know our decision as soon as possible