Senior Security Engineer, SpotHero

• Hat we’re looking for
• 5+ years of experience as a security engineer, demonstrating in-depth knowledge of application security principles, secure coding practices, and vulnerability management
• Proven ability to manage and prioritize security projects effectively
• Proficiency in developing and debugging in at least one programming language
• Experience conducting or participating in threat modeling and web/mobile application penetration testing
• Excellent communication skills, with the ability to effectively communicate complex security concepts to technical and non-technical audiences and collaborate with cross-functional teams
• Familiarity with cloud security controls and best practices. Experience with Amazon Web Services (AWS) is preferred but not required

Desirable

• SpotHero is looking for a Senior Security Engineer I to build and lead our Application Security Program
• This role involves close collaboration with engineering teams and product managers to integrate security throughout the entire product development lifecycle
• Conduct security-focused architecture, design, and code reviews
• Direct threat modeling and penetration testing exercises
• Lead the Security Champions program, empowering developers across teams to act as security advocates and fostering a culture of security awareness and best practices within the organization
• Document security guidance and secure coding best practices and provide training to the engineering organization
• Collaborate with customers, external security researchers, and developers to understand, document and assist in remediating reported vulnerabilities
• Contribute to the Vulnerability Management Program through the deployment and operationalization of security analysis tools
• Assist in responding to security incidents
• Tech you’ll work with
• Security analysis tools such as Semgrep or Docker Scout
• Languages: Python/Django, Go, Kotlin, Java, React/Redux
• Infrastructure: AWS, Kubernetes, Terraform