Senior Security Engineer, Forma.ai

• Six or more years of experience in security engineering, cloud security, application security, DevSecOps, or infrastructure engineering
• Strong hands-on experience securing AWS environments, including IAM, networking, encryption, logging, and secrets management
• Experience with Terraform, Kubernetes, containers, and security controls in CI/CD pipelines
• Strong understanding of application and API security, authentication, authorization, and multi-tenant SaaS risks
• Experience with vulnerability management, threat modelling, incident response, and security automation
• Ability to write scripts using Python, Bash, PowerShell, or a similar language
• Strong communication, troubleshooting, and cross-functional collaboration skills
• You're encouraged to apply even if your experience doesn't precisely match the job description

Desirable

• As a Senior Security Engineer, you will be a hands-on technical leader strengthening security across Forma's application, cloud infrastructure, development lifecycle, internal systems, and incident-response practices
• Security today is shared across Engineering and DevOps
• You'll work closely with both teams and have real room to shape how Forma approaches security as we grow
• Depending on your interests and the needs of the business, the role could develop into a deeper individual-contributor position or help build a dedicated security team
• You'll work directly with Engineering, DevOps, IT, Product, Legal, and Privacy to identify risks, design practical controls, automate security processes, and help teams ship secure and reliable software
• Design and implement security controls across Forma's AWS environments, with a focus on IAM, least-privilege access, service identities, and account boundaries
• Embed security requirements into Terraform and other Infrastructure as Code, and improve secrets, certificate, encryption-key, and credential management
• Build automated checks for insecure configurations, excessive permissions, exposed resources, and configuration drift across Kubernetes, containers, serverless workloads, networking, and data services
• Run threat modelling and security architecture reviews for new products, services, APIs, data pipelines, and third-party integrations
• Strengthen tenant isolation, authorization enforcement, and fine-grained data access controls at the schema, table, row, and column level
• Help protect sensitive compensation, financial, customer, and employee data across databases, data warehouses, S3, analytics services, and internal tools, including logging and auditability for sensitive-data access
• Review AI and agentic workflows for data leakage, prompt injection, insecure tool use, and excessive permissions; ensure agents operate strictly within the calling user's permissions; and define secure patterns for approved services such as Amazon Bedrock
• Identify and help remediate application vulnerabilities, and build tooling and reusable libraries that make the secure path the easy one for engineers
• Embed security testing into CI/CD — static analysis, dependency and container scanning, secrets detection, Infrastructure as Code scanning, and dynamic testing — without creating unnecessary friction for developers
• Define practical vulnerability-severity, remediation, exception, and escalation standards, and partner with developers to separate real risk from noise and fix root causes
• Improve software supply-chain security, including build permissions, artifact integrity, dependency governance, and GitHub administration
• Improve security visibility across cloud infrastructure, applications, identities, endpoints, and SaaS systems, and build alerts and detection logic that are worth acting on
• Lead investigations and coordinate containment, remediation, and root-cause analysis, supported by clear runbooks, ownership, and escalation paths
• Run tabletop exercises, and track and communicate security metrics and material risks to technical and business stakeholders
• Strengthen SSO, MFA, privileged access, and onboarding, offboarding, and access-review processes across AWS, GitHub, Microsoft 365, Entra ID, production systems, and internal SaaS — automating provisioning, entitlement reviews, and evidence collection where practical
• Translate security and compliance requirements into concrete technical controls, and support customer security reviews, audits, and programs such as SOC 2 and ISO 27001
• Evaluate third-party tools and integrations for security, privacy, and access-control risk, and help select, consolidate, and rationalize Forma's security tooling for both coverage and cost
• Maintain clear technical standards and provide practical guidance, training, and mentorship that raises security capability across Engineering
• First 30 days: learn and assess
• Build an understanding of Forma's application architecture, AWS environments, deployment processes, data flows, identity systems, and security obligations
• Meet key partners across Engineering, DevOps, IT, Product, Legal, and Privacy, and agree on how security reviews and escalations will operate
• Review existing controls, open findings, incidents, access patterns, monitoring, and compliance commitments
• Identify immediate risks, quick wins, and areas needing deeper assessment
• By 60 days: prioritize and improve
• Deliver a prioritized security roadmap based on risk, business impact, and engineering effort
• Begin addressing the highest-priority gaps in cloud access, secrets management, CI/CD security, vulnerability management, and monitoring
• Introduce or improve a consistent process for threat modelling and security architecture reviews, and define vulnerability-severity, ownership, remediation, and exception standards
• Assess the current security tool stack for coverage, overlap, and cost, with consolidation recommendations
• Improve incident-response runbooks, alert ownership, and escalation paths for critical systems, and recommend measurable security objectives and reporting metrics
• By 90 days: operationalize and lead
• The expectation here is momentum, not completion — these should be underway and demonstrably working, not finished
• A first set of automated security guardrails in place across AWS, Terraform, Kubernetes, GitHub, or CI/CD, with remaining coverage planned and underway
• Repeatable processes running for vulnerability management, access reviews, security assessments, and incident follow-up, even if still being refined
• Security reviews completed for the highest-priority product, data, or AI initiatives, with required controls agreed and in progress
• Improved visibility into high-risk identities, infrastructure changes, and sensitive-data access
• Progress, key risks, and the next phase of the security roadmap presented to leadership