Lead Product Security and Compliance Engineer

• Candidates must be open to work within USA time zones EST/EDT and PST/PDT hours.

Key Responsibilities

• Work directly with engineering teams to assist with fixing what you find
  • Pairing on remediation, explaining root cause, and building their ability to catch similar issues themselves, not just filing reports over the wall.
• Contribute and maintain SOC 2 compliance : control implementation, evidence collection, audit readiness, and ongoing maintenance as controls evolve.
• Champion secure development practices org-wide.
  • Secure SDLC, code review guidelines, threat modeling for new features, and security training/enablement for engineers.
• Select, set up, and manage the security tooling stack.
  • SAST/DAST scanning, dependency and vulnerability scanning, secrets detection, and coordination of periodic penetration tests.
• Own security incident response
  • Detection, triage, remediation, and blameless post-incident review, including the process itself, not just individual incidents.
• Own access control and data protection practices.
  • Least-privilege access reviews, data classification, and encryption standards across systems.
• Track and report on security posture and compliance status to leadership, in terms non-security stakeholders can act on.
• Stay current on emerging threats, relevant CVEs, and evolving compliance requirements (SOC 2 today, maybe ISO 27001 as we scale) and translate that into concrete changes to our practices.
• Run vendor security assessments, maintain security policy documentation, and act as the primary point of contact for external auditors.
• Build a security-first culture across engineering. The goal is a trusted advisor teams want to loop in early, not a gatekeeper they route around.

Skills, Knowledge and Expertise

• 6+ years of experience in product/application security, including demonstrated ownership of a SOC 2 (or comparable) compliance.
• Either built from scratch or carried through multiple audit cycles.
• Strong understanding of common vulnerability classes (OWASP Top 10 and beyond), with hands-on experience finding and fixing them, not just reading scanner output.
• Experience embedding security into the SDLC and shifting developer behavior.
  • Able to influence practices across teams without formal authority and without becoming a blocker to shipping.
• Familiarity with cloud security, AWS preferred to align with our infrastructure, and working knowledge of modern security tooling (SAST/DAST, SCA, secrets scanning).
• Hands-on ability to read, review and suggest fixes in production code in at least one backend language (Go, Node.js, Python or Java).
• Strong communication skills. This role works cross-functionally with engineering, operations, and leadership, and needs to translate technical risk into business terms auditors, customers, and executives can act on.

• Relevant certifications - CISSP, OSCP, CCSK, or similar.
• Experience with Go language, including Go-specific security tooling.
• Prior experience in a startup or scale-up environment, balancing security rigor against shipping speed.
• Experience with ad-tech, martech, or another high-throughput, latency-sensitive domain.
• Experience taking a company through ISO 27001 or a similar framework beyond SOC 2.
• Experience running or coordinating penetration testing engagements with external vendors.

Benefits