Lead Applications Security Engineer (Product)

How You’ll Make an Impact

Security plays a critical role at Copado in building and protecting customer trust. We need your help scaling our security initiatives as Copado expands its product offerings to new markets and customers. You’ll be in charge of Product Security, and be part of a small but mighty Security team, reporting to the Head of Security. 

What You’ll Do

• Conduct product design reviews, threat modelling, and technical security assessments of products to identify risks and provide security guidance
• Drive security architecture best practices across different product lines
• Scale the impact of our team through tooling and automation
• Track and drive vulnerability remediation across our code base and cloud infrastructure
• Partner with engineering teams to integrate reproducible security practices into the product development lifecycle
• Collaborate with Product, Engineering, Legal, IT and other internal stakeholders to provide recommendations for solutions focused on decreasing business risk
• Represent product security in our ISO27001, SOC 2, and FedRAMP audits 
• Author security guidelines and documentation

The Critical Competencies / Expertise You’ll Bring With You

• Collaborative Communication:  You engage and listen empathetically to others, adjusting your communication style to fit the audience and message. You are experienced in communicating with technical and non-technical audiences, leadership, internal and external parties.
• Mentoring: You enjoy using your knowledge and experience to support and uplevel those around you. 
• Motivated Learner: You learn new technologies, and processes quickly, and understand where and how to look for knowledge when you need it. 
• Holistic Focus: You can get into technical security issues, but you are able to consider the security landscape holistically, factoring in both the business and security context.
• Data Driven: Experience using data to inform decisions and familiarity with quantified risk.

The Experience You’ll Bring With You

• Deep understanding of application security best practices, and how those fit into web application architecture and design principles
• In-depth experience identifying and protecting against web application and web service security vulnerabilities including those found in the OWASP Top 10 and CWE Top 25.
• Demonstrated experience in building or up levelling an SDLC program.
• Strong organizational skills around compiling and disseminating the right amount of information for security issues to different types of audiences
• Relevant development experience in programming languages such as: Java, Python, JavaScript / Node.js

Highly Valued, But Not Required:

• In-depth knowledge of the Salesforce platform, GCP, or AWS
• Experience with security and compliance frameworks (ISO 27001, SOC 2, FedRAMP)
• Public speaking engagements or published research
• Professional security certifications (e.g., OSCP, OSCE)

You are a fit for Copado if:

• You’re a confident professional, able to balance competing demands and work independently.
• You’re energetic and enjoy working in a fast-paced global environment.
• You are able to undertake international travel - on average circa 1 week a quarter.
• You’re a jack of all trades, and always looking to learn more
• Head-over-heels about this role — but not sure you meet all the requirements? Apply anyway! Studies have shown that women and people of color are less likely to apply to jobs unless they meet every single qualification.