Staff Security Engineer, Grafana Labs

• Solid experience with at least one programming language. We primarily use Go, TypeScript, and Python but most languages translate well. You will take a code screen
• Deep knowledge of using and securing containerized, cloud-native applications, ideally with Kubernetes. Experience with multiple cloud providers is a strong plus
• Proven expertise in automating security compliance processes using tools, scripts, and frameworks while enabling developer and employee workflows
• Deep understanding of industry-recognized security frameworks, standards, and certifications, such as ISO 27001, SOC 2, PCI DSS, NIST, or GDPR
• Strong interpersonal skills. Experience collaborating (and negotiating) with peers, stakeholders, auditors, and customers
• Strong capability to manage multiple complex projects and deadlines simultaneously, ensuring timely delivery of security and compliance objectives
• A degree in Computer Science, Information Security, or related field (or equivalent experience)

Desirable

• We are looking for a Staff Engineer to be the technical lead of our GRC engineering team. You will be responsible for developing and implementing strategies to ensure we get and maintain industry certifications, and liaising with other teams delivering parts of our overall security posture
• The ideal candidate will have a proven track record of building, implementing and improving the maturity of security programs in Cloud-based SaaS organizations and possess excellent leadership and communication skills
• The Staff Security Assurance Engineer will collaborate across Grafana to articulate security policies, implement continuous monitoring, automate workflows, and write and deploy policies across all of our SDLC, applications, and infrastructure
• The ideal candidate will have a proven track record of building, implementing and improving the maturity of security programs in Cloud-based SaaS organizations and possess leadership and communication skills
• This role involved hands-on keyboard development, so programming chops and a deep knowledge of securing cloud-native, container-based architectures are critical. Knowledge of security standards and frameworks (ISO, FedRAMP, PCI-DSS, etc) is useful, but the disposition to quickly learn new things is more important than rote knowledge here
• Experience negotiating with peers, stakeholders, customers, and auditors is highly valuable. You will work alongside other security engineers, full-stack developers, and customer-facing teams
• Be a technical lead for our assurance team covering a range of areas, including certifications, application security, cloud security, and internal tooling development
• Develop, implement, and maintain highly automated security assurance programs to ensure compliance with organizational and regulatory requirements (e.g., ISO 27001, SOC 2, GDPR, NIST, PCI-DSS)
• Develop systems, automations, and methods of security observability to push the GRC engineering organization beyond just meeting certification requirements
• Deploy security and compliance checks in an employee-enabling way (guardrails and paved roads) in their daily workflows and build pipelines
• Define, optimize, and implement the engineering strategy in concert with the security leadership team, ICs and stakeholders across the business
• Design cutting-edge security metrics to show the security value of what we do
• Coach and mentor to ensure your team members are motivated, happy and engaged. Provide continuous feedback to ensure that they can add value while maintaining high standards
• Collaborate with cross-functional teams to integrate security controls into the software development lifecycle and operational processes
• Respond to customer security issues, security alerts, and potential incidents