Product Security Engineer, Hex Technologies

• 5+ years of product-security experience: 4 years in appsec, 1 in cloudsec
• You write code and are fond of creating your own automation
• Deep understanding of software-security principles and a good understanding of cloud-infrastructure security principles
• Hands-on experience with many of the core infrastructure products that Hex is run on, including Kubernetes, AWS, and Terraform
• You perform code reviews regularly
• Proficient at threat modeling and keeping the models updated
• Able to break down a landscape of scattered security problems, whether complex, simple and/or varies, and group them into logical, achievable components to get the most bang for the buck during quarterly and annual planning
• Possess an instinct for strategic thinking and aligning with business and product goals, while keeping a healthy balance of velocity and security excellence
• Excel at working with several different engineering teams and codebases, and at communicating with engineers and non-technical partners across many different backgrounds, demonstrating curiosity about how their work contributes to Hex’s success

Desirable

• Join us in developing a proactive, technology-forward product-security discipline, dedicated to eliminating vulnerabilities in application and infrastructure before they even occur
• You’ll own the SSDLC and ensure effective security measures are embedded throughout
• You’ll be building systems and occasionally building/buying tools that help all of Engineering truly shift left, so you can spend less time chasing vulnerabilities and more time on meaningful security engagement
• Additionally, this role includes practicing embedded security within Eng teams, teaching them to think through, prevent, and mitigate common security issues all on their own: everything from creating guardrails to implementing AuthN / AuthZ correctly to creating secure and resilient infrastructure as code
• Hardening our Kubernetes deployments
• Running and evolving our Bug Bounty Program
• Streamlining our product authorization model
• Optimizing access control company-wide
• Automating vulnerability management