Lead Security Engineer, AllTrails

• 10+ years of experience leading cybersecurity or corporate security programs, with a focus on securing large-scale web/cloud applications and infrastructure
• 5+ years experience with AWS
• Expertise in security infrastructure, including SIEM, firewalls, intrusion detection, identity and access management, and vulnerability management
• Familiarity with various software development life cycles and product security programs
• Proven experience in managing security incidents, including root cause analysis, executive briefings, and communication strategies
• Experience leading bug bounty programs, penetration testing, and triaging security findings
• Strong cross-functional collaboration skills with internal teams (business, engineering) and external incident response teams
• In-depth knowledge of security compliance requirements, such as GDPR, and guiding organizations through compliance processes
• Hands-on experience with Infrastructure-as-Code frameworks (e.g., Terraform) and automating security tools and processes (e.g., using Bash, Python)
• Humility, empathy and open-mindedness - no egos
• Believe that strong teams are built on trust and autonomy
• Passion for the outdoors

Desirable

• As the Lead Security Engineer at AllTrails, you’ll play a pivotal role in our continued growth and expansion by leading and managing security functions across the organization
• You'll also be deeply involved in our infrastructure and engineering projects to help deliver on our vision of fostering happy, healthy communities by connecting people to the outdoors and to each other
• Serving as an engineering leader and expert on security
• Define and implement the security roadmap, ensuring compliance with company requirements and industry standards
• Drive automation and toolchain improvements to enhance security processes
• Collaborate across teams (Engineering/IT/Compliance) to maintain alignment on security policies, workflows, and service level agreements
• Integrate security into development workflows and infrastructure using automation, infrastructure-as-code, and cloud security scanning techniques
• Act as a hands-on leader in security tool integration, ensuring seamless integration into CI pipelines and deployment systems