Senior Security Engineer, PagerDuty

• The ideal candidate will have a blend of experiences across large enterprise environments and small or mid-size environments and will have focused on establishing security standards, coordinating with product development teams, developing strategies for secure-by-default architectures, and corresponding process and tooling selection and implementation
• Things that make you smile: secure product architectures, providing an engaging Developer Experience for security adoption, and cute animal memes
• 5+ years of experience as a Security Engineer focused on product and application security in a cloud-native, microservices environment, preferably within AWS
• Demonstrated experience with security standards and patterns for APIs, microservices, and serverless architectures, including best practices for secure SDLC integration and development
• Familiarity with cloud-native product technologies including:
• Vulnerability detection via multiple approaches including SAST, DAST, SCA, and runtime (e.g., Qualys/Nessus, Wiz, Snyk, etc.)
• Security event collection and analysis (e.g., SIEM such as: SumoLogic, LogRythm, or Splunk, etc.)
• Container Security (e.g., Kubernetes, EKS)
• CI/CD technologies and integrations (e.g., CircleCI, Buildkite, Helm, Terraform, Chef)
• Security Incident Response & Risk Management processes and tools
• 4 years of experience and proficiency in at least one programming language and framework (e.g., Python, Bash, Phoenix/Elixir, Java, Ruby on Rails)
• Exceptional written, oral communication, and interpersonal skills
• Strong organizational skills with the ability to successfully manage multiple priorities and deadlines

Desirable

• PagerDuty is seeking a Senior Security Engineer to join our diverse, customer-focused team
• As a Senior Security Engineer, you will be a key contributor in leading, driving and delivering security initiatives for PagerDuty’s SaaS offerings, focusing on application & product security through architecture reviews, threat modeling sessions, and defining secure-by-design product standards and protections that support PagerDuty’s security mission
• Since we own and operate what we build, you’ll collaborate closely with engineers across many product development teams
• You will work closely with our internal development teams to ensure we deliver secure, highly reliable, and scalable solutions to our customers
• This is an exciting opportunity to build security solutions that make developers and customers happy
• Embrace the role of hands-on technical lead in defining product security standards and guiding platform protections
• Establish criteria and conduct comprehensive security reviews throughout all stages of product development to identify and address security risks
• Perform regular threat assessments, coordinate with third-party testers for penetration testing, and conduct internal penetration testing to identify and mitigate security risks
• Mentor and guide team members to ensure product and business objectives are prioritized in project implementations, fostering a strong documentation culture with project charters and design documents
• Work with loosely defined requirements where you exercise your analytical skills to clarify questions, share your approach, and collaborate with the team to design and implement effective security frameworks. Maintain a strong appetite for challenging problems with a high degree of ownership
• Participate in the team’s On-Call rotation, triaging and addressing security issues as they arise, and implement measures to prevent future occurrences
• Enable service team security implementations by developing security-as-code constructs, including infrastructure-as-code (IaC) modules, libraries and frontend components, while creating and maintaining developer-focused documentation to promote easy adoption
• Establish and uphold baseline standards and hardened configurations for platform components
• Continuously enhance security frameworks by focusing on product security standards and software supply chain protections, tailored for application security in cloud-native, microservices environments