Senior Security Engineer, Redox

• 5+ years in security engineering with a track record of hands-on delivery across system hardening, security engineering projects, and peer mentorship
• Strong technical proficiency in Kubernetes security, specifically network policy orchestration, admission control (Kyverno), and container hardening protocols
• Experience with threat modeling for applications built using Node.js, TypeScript, Python or Go
• Hands-on experience supporting secure SDLC practices and CI/CD safeguards using GitHub Actions, ensuring artifact validity and pipeline integrity
• Direct experience hardening Infrastructure-as-Code (Terraform) and managing enterprise secrets via AWS Secrets Manager, Vault, or similar platforms
• Solid experience across the vulnerability management lifecycle, from initial triage to production remediation
• Ability to apply compliance frameworks like HITRUST and SOC 2 into pragmatic technical controls that align with engineering workflows
• Strong written communication skills, with the ability to clearly document decisions and collaborate effectively within a remote, asynchronous organizational culture
• Proficiency in AI tools and techniques, including prompt engineering and hands-on experience across multiple large language model platforms, with a demonstrated ability to automate workflows using AI

Desirable

• We are seeking a Senior Security Engineer to take ownership of cloud-native and application security across the Redox platform
• This is a high-impact, hands-on IC role where you will move beyond identifying risks to actively hardening our environment, performing code reviews, and translating complex control gaps into engineering proposals that drive production impact
• You will function as a partner to our Engineering teams, embedding security into the SDLC through hands-on work across container security, Kubernetes hardening, and architecture reviews
• You'll follow and reinforce our established security standards, helping make the secure path the easy path for the engineers you work with day to day
• As part of a small, senior security team, your day to day work will directly strengthen how we protect data for our customers, with impact concentrated in the systems and teams you own
• Own Cloud Security Posture Management including Kubernetes and Container security practices, admission control, network policies, image integrity, and environment hardening
• Manage comprehensive vulnerability lifecycles, prioritizing remediation based on actual production exposure rather than simplistic finding metrics
• Collaborate with Platform Engineering to support secure SDLC and CI/CD safeguards, focusing on artifact validity and pipeline integrity
• Convert HITRUST and SOC 2 compliance frameworks into actionable technical configurations and operational controls
• Evaluate and secure infrastructure-as-code across all environments
• Execute incident response duties, encompassing forensic investigation and the facilitation of blameless post-mortem analyses
• Contribute to security standards within Engineering through design reviews, collaborative pairing, and mentorship of peers
• Support bug bounty triage and maintain professional engagement with external security researchers
• Our stack - you'll be hands-on with these:
• AWS, Docker, EKS
• Crowdstrike, Jamf, Okta, GuardDuty, Sumologic
• Kyverno, Karpenter, KEDA, VPA, Velero, Crossplane
• Github Actions, Terraform, Helm, ArgoCD and Atlantis
• Postgres, Redis, Kafka
• Our Engineering Culture & How We Work:
• Transparency, Ownership & Autonomy:
• We make room for everyone to be heard, regardless of level
• We work openly, normalize not knowing things, and treat "learning out loud" as a feature, not a liability
• You'll be expected to bring your real perspective, push back when you see something wrong, and commit fully once a decision is made
• As a Senior Engineer, you help cultivate our culture: you model the behavior, you embrace questions, you acknowledge mistakes
• We default to public Slack channels over DMs, post Zoom summaries back in writing, and work async whenever possible
• We'd rather expose incomplete thinking in public to get better feedback than protect it in private
• That applies to security work too, when you identify a risk or propose a control, you bring it to the table with a recommendation, not just a concern
• We own the systems we maintain, not just the new features on the roadmap
• You'll have room to identify platform security work, propose scope, consult on priority, and see it through from design to operationalization
• We measure ourselves by the value we deliver, not the process we follow