Application Security Specialist, Shift Technology
DevSecOps
+ Variable component tied to personal and company performance; + Equity
AI-driven insurance fraud solution
Be an early applicant
AI-driven insurance fraud solution
501-1000 employees
Be an early applicant
+ Variable component tied to personal and company performance; + Equity
501-1000 employees
Company mission
To revolutionise the policyholder experience through wide-ranging products that apply AI and advanced data science to key insurance processes.
Role
Who you are
- The ideal candidate will have deep, hands-on expertise in either DevSecOps or Cloud Security, with a strong willingness and proven ability to operate across the full security lifecycle, including security operations and incident response
- 7+ years of experience in technical security roles with a degree in Computer Science, IT, Systems Engineering, or equivalent practical experience
- Proven experience working in regulated environments (e.g., ISO 27001, SOC 2, GDPR) and with common security frameworks (OWASP, MITRE ATT&CK, NIST CSF)
- Deep, hands-on experience in at least one of the following core areas:
- DevSecOps & Application Security:
- Automating security testing (SAST, DAST, SCA) in CI/CD pipelines
- Direct experience with application vulnerability management tools (e.g., GitHub Advanced Security, Tenable, ZAP, Burp Suite)
- Strong knowledge of API, web application, and software supply chain security (SBOM)
- Understanding of major development language frameworks (C#, Java, React, Python, etc.)
- Cloud Security & Security Operations:
- Strong knowledge of Azure security services (Entra ID Suite, Sentinel, Defender for Cloud, Key Vault, Policy)
- Direct experience with Cloud and Endpoint Security concepts and tools (e.g., Palo Alto Cortex XDR, Prisma SASE, CASB, DLP, CSPM, IDS/IPS)
- Proficiency with cloud networking and firewalling (e.g., Palo Alto Panorama/NGFWs, WAFs, Cloudflare)
- Knowledge of SIEM, SOAR, Detection and Response Engineering concepts
- Strong knowledge of modern IDAM technology and concepts (e.g., Okta, SailPoint, PAM, SAML, OAuth/OIDC, SCIM)
- Experience with endpoint security, predominantly Windows
- Experience with Azure cloud infrastructure, container technologies (Kubernetes) and engineering scripting languages (Python, PowerShell, Terraform)
- Familiarity with managing vulnerability disclosure programs and tooling (e.g., HackerOne Bug Bounty, Drata, Jira)
- Excellent communication skills with a proven ability to engage and collaborate well with technical teams, represent security at multiple levels, and act as a subject matter expert
- A can-do attitude with the ability to own your own work, work independently, unblock yourself and others, and drive the team's mission forward
- Strong attention to detail and analytical skills, a diligent and creative approach to problem-solving, and the ability to educate and guide others on security principles
- Good situational awareness, a solid understanding of cybersecurity trends and a passion for continuous learning
What the job involves
- The security team is a critical component of Shift Technology as no organization is immune to cyber-crime
- The team is responsible for protecting information throughout the security infrastructure, edge devices, networks, and data
- We strive to stay up to date with the latest tactics hackers are employing in the field in order to prevent data breaches by monitoring and reacting to attacks but the first step is finding the most qualified professionals to lead the way
- As a Security Engineer within Shift, you will have end-to-end ownership of security for our products and platforms. This is a unified role that blends DevSecOps and SecOps, responsible for securing our software from the first line of code, through the CI/CD pipeline, and monitoring it in production to detect and respond to threats
- You’ll join a team and a company where you can own and drive, and progress your career to the next level
- As part of the information security department, this role reports to the CISO
- Working with data scientists, software delivery teams, and engineers, to ensure technical security standards and architectures are well understood and best practices are followed, so the software is developed with Security and Privacy by Design and by Default
- Driving Application Security through defining technical policies, standards and guidelines and championing these throughout the organisation
- Identification of systemic and cultural developer security issues, and remediation opportunities
- Interest in Data Science, Engineering and ML Security on Azure and AWS
- Leading and facilitating threat modeling exercises
- Automation of security testing (SAST, DAST, SCA, Vulnerability management)
- Ensuring full benefits realisation of relevant tooling
- Ensure maximum code and infrastructure coverage
- Ensure company-wide best practices for Secret Management, IaC Security, and SBOM
- Security auditing of software developed by the company and its partners
- Operate a software vulnerability management program, taking responsibility for the identification, production and improvement of meaningful metrics, and reporting on progress
- Prioritise and manage the remediation of code defects
- Maintenance of a holistic view of the code and infrastructure estate, our security tooling coverage, and compliance readiness engineering
- Collaborate with key stakeholders (including engineering leads, infrastructure, SRE, and cloud operations) to identify security risks, architectural flaws, process gaps, and software vulnerabilities
- Technical liaison with third parties on application security related discussions related to security
- Develop, maintain, and execute appropriate incident response processes to enable timely escalation, containment, and recovery of cyber security events
- Work with other teams to identify recurring patterns and propose strategic actions to reduce risk
- Provide clear, concise, and easily consumable communication with key technical and non-technical stakeholders so that incidents, KPIs, and KRIs are understood and appropriately addressed
- Provide considered definitive technical responses to customer penetration tests
Application process
- TA Interview
- Security team interview
- Technical interview
- CISO interview
- CTO interview
Our take
The global insurtech market is projected to grow substantially given the increased demand for insurance service digitisation, projected market expansion, and developments in technology that have made it easier to buy and process claims. Insurtech helps create new avenues that large insurance companies have less incentive to pursue, such as offering social insurance and customised policies for clients.
In January 2021, Shift Technology introduced the Shift Insurance Suite to help the insurance industry apply AI-based decision automation and optimisation technology solutions. This addresses critical processes across the insurance policy lifecycle, as well as helps insurers to achieve faster, more accurate claims and policy resolutions.
Shift Technology is focusing on continuous deployment in the UK and the US, whilst exploring opportunities in Singapore, as it attempts to become an international player in the market. However, it must stave off a number of major competitors to do so, including Quantemplate, Slice and Neos.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
-1% employee growth in 12 months
Company
Funding (last 2 of 7 rounds)
May 2021
$220m
SERIES D
Mar 2019
$61.8m
SERIES C
Total funding: $321.8m
Company benefits
- Flexible remote and hybrid working options
- Competitive Salary and a variable component tied to personal and company performance
- Company equity
- Generous PTO and paid holidays
- Parental leave opportunities
- Extensive mental health benefits provided via our global Employee Assistance Program
- Paid volunteering time - 16 hours annually
Company HQ
Bercy, Paris, France
Leadership
Jeremy Jawish
(CEO)Experience in fraud detection solution development for AXA in 2011, and as an FICC Strategist for Goldman Sachs in 2012.
Eric Sibony
(CSO)PhD in machine learning from 2012-2016, and has been CSO since 2013.
David Durrleman
(Fellow Engineer)Experience as a Fixed Income Strategist for Goldman Sachs between 2008-2013.
Share this job
View 13 more jobs at Shift Technology