Remote SecOps Engineer - Secure by Design & Cloud Posture

Clutch; Half Moon Bay (CA); Remote; USD 96,000 - 152,000; Full time

Benefits offered by this job

Remote work

Off-sites twice a year

20 PTO and holidays

Stock options

Home office setup budget

Work trip budget

Job summary

Clutch is seeking a Senior SecOps Engineer to shape and execute application and cloud security posture in a fast‑paced fintech environment. You will embed with engineering, drive secure design, threat modeling, and proactive risk mitigation across services and cloud infrastructure.

You will own vulnerability identification, remediation, and security tooling integration, helping establish a Secure SDLC and robust cloud controls.

Qualifications

• 5+ years of experience in software/application security, ideally in fintech or fast‑growing startups.
• Deep knowledge of web app security, secure design, API hardening, and threat modeling.
• Experience integrating security into CI/CD pipelines with SAST/DAST/SCA and IaC scanning.
• Familiarity with SOC 2, GLBA, PCI-DSS and cloud security (AWS, GCP).
• Strong coding background in Node.js/Python/Go and ability to read and secure code.

Responsibilities

• Assess security posture across applications, cloud accounts, and pipelines and map top risks.
• Embed with engineering to review secure design and provide practical guidance.
• Integrate security tooling into CI/CD pipelines (SAST/DAST/SCA, IaC scanning).
• Lead Secure SDLC design, establish security gates, and implement cloud controls and logging.

Skills

SecOps

Cloud security

Threat modeling

CI/CD security

SAST/DAST

Python/Node.js

Kubernetes

Tools

Terraform

Kubernetes

Secret scanning

SCA tools

CI/CD tooling

Job description

Clutch is seeking a Senior SecOps Engineer to shape and execute application and cloud security posture in a fast‑paced fintech environment. You will embed with engineering, drive secure design, threat modeling, and proactive risk mitigation across services and cloud infrastructure.

You will own vulnerability identification, remediation, and security tooling integration, helping establish a Secure SDLC and robust cloud controls.