Senior SecOps Engineer

Summary:

The Senior SecOps Engineer at Showpad will play a crucial role within the Security Operations team, collaborating with various departments, including Engineering, Product, and other business units. This position focuses on identifying, managing, and mitigating cybersecurity risks, particularly in cloud-native environments, to enhance security capabilities. The ideal candidate will possess solid experience in SecOps practices and a deep understanding of modern security methodologies.

Responsibilities:

• Manage cybersecurity operations, including tasks related to application, hardware, and cloud infrastructure security.
• Act as the key cybersecurity contact for internal teams regarding daily practices, company-wide initiatives, and the Showpad product.
• Ensure development teams adopt and implement best practices in software security development.
• Enable development teams by providing CI/CD processes that integrate security and quality tooling.
• Manage and improve our CNAPP solution.
• Oversee and manage cybersecurity operations, ensuring continuous monitoring and protection of cloud infrastructure and applications.
• Manage and respond to events related to vulnerability programs, endpoint protection, user behavior analytics, firewalls, IDS/IPS, and external threat intelligence.
• Collaborate with internal teams to ensure security best practices and policies are adhered to across the organization.
• Develop and maintain security controls and automation strategies within CI/CD pipelines.
• Monitor and assess risks, manage vulnerabilities, and implement appropriate security measures.
• Required Skills: Proven experience in information security, with a background in security operations, application security, or related roles.
• Skilled in identifying, analyzing, and handling phishing attempts and other social engineering threats.
• Strong knowledge of modern web application security practices and frameworks.
• In-depth understanding of the Secure Software Development Life Cycle (SSDLC).
• Experience implementing security automation for testing, monitoring, or orchestration workflows in Typescript or similar.
• Proficiency in container technologies, such as Docker and Kubernetes, and serverless environments like AWS Lambda, with hands-on experience securing cloud-based applications, preferably in AWS.
• Knowledge of securing microservices-based architectures.
• Practical experience conducting security assessments, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA).
• Experience managing vulnerabilities through bug bounty programs, penetration testing, and automated security scanning.
• Understanding of security and privacy frameworks, such as GDPR, ISO 27001, and SOC 2, is an asset.
• Strong English communication and presentation abilities, with the capacity to explain complex security concepts to both technical and non-technical audiences.