About this role:
In this Security Software Engineer role you will be responsible for authoring, maintaining, and extending software to improve the security of our product. You’ll contribute to our web service code and cloud infrastructure, updating and hardening our products against attacks and implementing secure architecture patterns. You’ll review engineering design docs, operate security tooling, and create automation to improve the velocity of our security operations processes. In this role you will report to our Security Engineering Manager, participate in Scrum agile processes, and play a specialist role among the software engineers at Super.com. Expect a culture of high autonomy, frequent collaboration, fast pace, and reliance upon your own initiative.
What you'll be working on:
- Automate and orchestrate security tooling by writing Python scripts and services
- Patch and secure our full-stack web services, applying fixes to identified vulnerabilities and implementing architectural improvements across the full range of Super.com’s products
- Act as a point of contact for reviewing the security, exploitability, and fraud risk of software changes
- Contribute a security perspective to major engineering designs and projectsIndependently identify current vulnerabilities within our product, and verify the accuracy and exploitability of detected/submitted vulnerabilities, including by implementing proofs of concept
- Operate closely with product engineers, Fraud, DevOps, and other parts of the business as a company technical resource
- Participate in our Security Operations process, responding to threat signals and incidents as they arise.
Our Technology:
- We use a state of the art architecture powered by Node and Python microservices and React frontend
- We use Postgres for storage, Redis for caching, and Snowflake for our data warehouse
- We use Gitlab for version control and CI/CD, and our infrastructure is hosted on AWS, making use of Kubernetes, RDS, etc
- We invest heavily in monitoring and automated alerting using Datadog
- We use Amplitude, Hotjar, and LogRocket for client-side metrics and experimentation
- We use Material-UI and maintain our own component library, using Figma for mock-ups
- We integrate with a multitude of third-parties to support our compliance, risk, and security policies
Who we're looking for:
- 3+ years experience professional full-stack software development
- 1+ year experience working in the security space, or equivalent education / experience
- Intermediate Software Engineer level experience with Python and React specifically
- Ability to identify vulnerabilities in software. Familiarity with the OWASP top 10, modern security tools, and a proven ability to apply identified vulnerabilities to exploit systems.
- Experience working in a fast-paced and technology focussed Agile environment Familiarity with major cloud infrastructure components such as AWS Cloud, Kubernetes, and Cloudflare
Bonus points for:
- Proven success finding vulnerabilities in Bug Bounty programs, CTF events, etc
- Independent development visible on GitHub of full-stack web applications
We Believe in Equal OpportunityWe are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.Accommodations are available on request for candidates taking part in all aspects of the selection process. If needed, please notify our Talent Acquisition Partner.
Report job
