Senior Application Security Engineer, CloudZero
More information about location
Cloud-computing cost intelligence software
Be an early applicant
Cloud-computing cost intelligence software
21-100 employees
Be an early applicant
More information about location
21-100 employees
Company mission
CloudZero's mission is to empower engineering leaders to be elevated to business leaders they should be — by creating a shared language for them and the rest of their company to discuss cost.
Role
Who you are
- 3-5+ years of Python experience
- 3-5+ years of AWS, GCP, and Azure experience
- Strong foundation in application security
- Proven expertise with application security testing tools, such as Burp Suite
- Strong understanding of OWASP Top 10
- Experience conducting penetration tests, including manual testing, to uncover business logic flaws, API vulnerabilities, and complex attack vectors
- Familiarity with SCA tools (e.g., Snyk, Dependency-Check) to manage open-source security risks
- Hands-on experience securing AWS environments, including services like Lambda, IAM, GuardDuty, Security Hub, and WAF
- Knowledge and experience securing CI/CD pipelines
- Strong understanding of secure coding practices, vulnerability management, and compliance frameworks (e.g., SOC 2, ISO 27001)
- Familiarity with threat modeling frameworks and experience applying them to real-world applications
- Exceptional communication skills, with the ability to explain technical concepts to developers, executives, and non-technical stakeholders
- A proactive mindset with a passion for enabling developers to adopt secure practices without friction
- Ability to participate in our incident response team on-call rotation
What the job involves
- CloudZero is seeking our first Senior Application Security Engineer
- In this pivotal role, you will shape the security framework of our market-leading cloud cost intelligence platform, addressing some of the most critical challenges cloud-driven businesses face today
- You will establish and champion best-in-class security practices, ensuring our platform remains resilient and our customers’ sensitive data is always safeguarded
- Collaborating closely with our engineering teams, you will design and implement secure development processes, identify and address vulnerabilities, and foster a security-first mindset throughout our product lifecycle
- This is a unique opportunity to make a foundational impact on the security of an innovative, fast-growing company by building scalable, proactive solutions that protect both our platform and the customers who trust us
- Develop and Lead Security Programs:
- Build and lead our application security program, aligning security initiatives with business and engineering priorities
- Champion and drive a Security Champions Program to empower developers and cultivate a security-first culture across the organization
- Integrate Security into Development:
- Promote and implement processes that make security a shared responsibility, integrating it seamlessly into our development lifecycle
- Equip developers with the tools and guidance to make secure choices easy, scalable, and effective
- Collaborate Across Teams:
- Partner with Engineering and the broader Security organization to embed security into development and deployment processes
- Work closely with Engineering and SecOps teams to secure our AWS-based infrastructure, ensuring adherence to best practices for identity management, logging, and secure configurations
- Collaborate with Security and Operations teams to align on broader security initiatives and enhance overall resilience
- Security Assessments and Risk Mitigation:
- Conduct security assessments, code reviews, threat modeling, and penetration testing to identify and mitigate risks early
- Manage and optimize application security tooling, including static (SAST) and dynamic (DAST) analysis tools and CI/CD integrations
- Automation and Innovation:
- Explore and implement security automation to improve efficiency and coverage, utilizing your Python expertise to build scalable tools and workflows
- Stay ahead of emerging threats, trends, and technologies to keep our applications, APIs, and cloud environments secure
- Incident Response:
- Participate in our incident response team on-call rotation to address and resolve security incidents promptly
Our take
Cloud infrastructure has become the crucial foundation for almost all digital native businesses. However, as these companies expand that means ballooning cloud computing costs, often approaching 1/3 of a company's IT budget.
Since finance teams are not usually specialists in the scaling requirements and value of cloud infrastructure, that means businesses as a whole are sometimes failing to properly evaluate a critical part of their organization's spend.
CloudZero fixes this by providing transparency into a company’s cloud server costs. Its platform works by aligning engineering, infrastructure, and finance teams around metrics that non-technical teams can work with. The company has built a solid customer base of over 100 businesses including the likes of SkyScanner, Remitly and SeatGeek.
The company has recently closed a Series B funding round. It is using this capital and its growing revenue to further develop its platform and scale its marketing. As businesses will increasingly struggle with their cloud computing spend, CloudZero is well poised to provide a solution.
Freddie
Company Specialist at Welcome to the Jungle
Insights
Few candidates hear
back within 2 weeks
47% employee growth in 12 months
Glassdoor (5)
Company
Funding (last 2 of 6 rounds)
Nov 2023
$9.5m
LATE VC
Jun 2023
$32m
SERIES B
Total funding: $57.2m
Company benefits
- Comprehensive Healthcare Coverage
- Equity Grants
- Flexible Remote Work Policy and PTO
- 401(k) Retirement Plan
Company HQ
Government Center, Boston, MA
Articles
Leadership
Erik Petrson
(CTO/CISO & Co-founder)Previously Director of Technology Strategy as part of Veracode's CTO office. Also worked as Director of Products for HP and as VP of Products & Research for SPI Dynamics before it was acquired by HP.
Matt Manger
(Co-founder)Previously Director of Services for technology company, Toast. Also held senior positions at Veracode and Endeca. Formed US Air Force Flight Commander.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 9 more jobs at CloudZero