Senior Lead Engineer, Information Security

Key Responsibilities

Security Engineering & Architecture

• Design, implement, and maintain enterprise security controls across cloud, infrastructure, and application environments.


• Evaluate emerging threats and technologies and recommend improvements to the organization's security architecture.


• Develop security standards, engineering patterns, and technical guidance to improve the overall security posture.

Security Automation & DevSecOps

• Design and develop security automation solutions that improve operational efficiency and reduce manual effort.


• Integrate security controls and validation activities into CI/CD pipelines and software delivery workflows.


• Build and maintain GitHub Actions and related automation to support secure development practices.


• Automate vulnerability management, policy enforcement, reporting, and remediation tracking activities.

Application Security

• Lead security engineering efforts focused on protecting internally developed applications and APIs.


• Perform and coordinate: 
  
  
  
  • Threat modeling
  
  
  • Secure design and architecture reviews
  
  
  • Secure code reviews
  
  
  • Static Application Security Testing (SAST)
  
  
  • Dynamic Application Security Testing (DAST)
  
  
  • Software Composition Analysis (SCA)
  
  
  • Open-source dependency and supply chain security reviews
  
  
  • Secret and credential exposure detection
  
  
  • API security testing and assessments
  
  
  • CI/CD pipeline security reviews
  
  
  • Security validation of application deployments
  
  


• Partner with development teams to identify, prioritize, and remediate security risks.

Web Application Firewall (WAF) & Edge Security

• Design, implement, and maintain Web Application Firewall (WAF) capabilities.


• Develop and tune security rules, attack detection logic, bot mitigation, rate limiting, and application-layer protections.


• Continuously monitor and improve protections against OWASP Top 10 and emerging web application threats.

Offensive Security & Penetration Testing

• Conduct application red team exercises and adversarial security assessments.


• Perform manual and automated penetration testing of web applications, APIs, and supporting services.


• Simulate real-world attack techniques to identify weaknesses in application design, authentication, authorization, and deployment architectures.


• Document findings, provide remediation guidance, and validate corrective actions.

Collaboration & Security Operations Support

• Partner with engineering, infrastructure, and cloud teams to implement secure solutions.


• Support incident response investigations involving applications, cloud services, and development platforms.


• Provide technical leadership and mentorship on security engineering practices and security tool adoption.

Success Measures

• Increased automation and efficiency of security processes.


• Successful integration of security controls into engineering and CI/CD workflows.


• Reduction of application and cloud security risks.


• Effective implementation and management of WAF protections.


• Timely identification and remediation of vulnerabilities.


• Successful execution of penetration testing and red team activities.


• Improved security posture across applications, APIs, and software delivery platforms.


•