Security Engineer (DevSecOps & Compliance)

Zeely Inc.; United States; Remote; USD 140,000 - 230,000; Full time

Job summary

Zeely Inc. приглашает Lead Security Engineer для руководства безопасностью продуктов и инфраструктуры. Вы будете сочетать владение направлениями и hands-on инженерию, внедрять безопасную архитектуру и управлять SOC2/ISO27001 в связке с DevSecOps.

Работа предполагает участие в CI/CD, реагирование на инциденты и взаимодействие с аудиторами. Компания Zeely — лидер в AI‑платформе для создания маркетинга, с ростом и международными инвесторами.

Qualifications

• 7+ лет опыта в DevOps, Platform или инфраструктуре, из которых как минимум 4 года в области безопасности.
• Опыт работы с SOC2 и ISO27001: подготовка к аудиту и взаимодействие с аудиторами.
• Сильный опыт AWS и инфраструктуры как код с Terraform.
• Доказанный опыт выявления и устранения уязимостей и реагирования на инциденты.
• Опыт руководства инженерами или техническим лидером.
• AWS Professional‑level сертификация (или эквивалентная).
• Уровень английского не ниже B2; знание украинского.
• Опыт бэкэнд‑разработки (Node.js/TypeScript, Java, C#/.NET, Go, Python) или путь от бэкэнда к DevOps/Platform to Security.
• Опыт работы с CASA‑оценками; GDPR/CCPA (CPRA) внедрение.
• Знание HIPAA или PCI DSS; другие сертификации CISSP/OSCP/CKS/GCP.

Responsibilities

• Обеспечить AWS‑первичную безопасность и hands‑on: IAM, управление доступом, секретами, минимизацию уязвимостей и сетевую безопасность.
• Взять на себя инициативы по комплаенсу (SOC2, ISO27001, CASA): реализовать контролли и взаимодействовать с аудиторами.
• Встраивать безопасность в CI/CD: SAST, DAST, SCA, сканирование секретов и проверки инфраструктуры как код.
• Находить, приоритизировать и исправлять уязвимости в продуктах и инфраструктуре.
• Проводить инцидент‑реагирование и налаживать мониторинг и alerting.
• Определять инициативы по безопасности и владеть дорожной картой безопасности.
• Обзор архитектурных решений и кода с точки зрения безопасности.
• Устанавливать политики и процессы безопасности, обучать команды DevOps и Platform внедрению.
• Поддержка B2B клиентов по вопросам безопасности, обзоры и due diligence.

Skills

Security engineering

AWS

Terraform

SAST

DAST

SCA

Incident response

Leadership

Auditing

Security certifications

Education

AWS Professional-level certification

CISSP

OSCP

CKS

GCP security certifications

Tools

Terraform

SAST tools

DAST tools

SCA

CI/CD security tooling

Job description

Описание:

Join Zeely as a Lead Security Engineer and help us strengthen and scale security across our products and infrastructure. This role combines high ownership with hands‑on engineering. You’ll lead our security direction together with our DevSecOps / Security Engineer: securing our AWS environment, closing security tasks yourself, and owning our SOC2 and ISO27001 compliance. You’ll work closely with our Principal System Architect and the Platform, DevOps, and Backend teams as a trusted partner with real authority over technical decisions from a security perspective.

Zeely is the agentic AI platform for creating, launching, and scaling paid ads. Simply put: we’ve made the best AI solutions and marketing tools available to small and medium businesses — tools that used to be reserved for big brands with expensive marketing teams. The next big step: a B2B solution for large marketing teams and enterprise clients — workflows, creative analytics, and full control over campaigns across the whole team. For companies where performance marketing already runs at scale and needs more efficiency and automation.

A few numbers that speak for themselves:

• 4 years on the market — a stable, profitable company backed by international investors
• 6× growth over the past year
• 2,000,000+ businesses already use Zeely
• #1 in its category in the US market
• 250+ specialists on the team
• Markets: US+ worldwide

We’re not a startup searching for product‑market fit — we’re a business with proven results and a clear understanding of what works.

Задачи:

• Secure our AWS‑first cloud environment hands‑on: IAM and access management, secrets, hardening, and network security
• Own compliance initiatives (SOC2, ISO27001, CASA): implement controls, prepare evidence, and work with auditors
• Build security into CI/CD: SAST, DAST, SCA, secrets scanning, and infrastructure-as-code checks
• Find, prioritize, and fix vulnerabilities across our product and infrastructure, closing critical security tasks yourself
• Run incident response and set up monitoring and alerting
• Define and prioritize security initiatives and own the security roadmap
• Review architecture decisions and code from a security perspective
• Set up security policies and processes, and guide the DevOps and Platform teams on implementation
• Support B2B clients with security questions, reviews, and due diligence

Требования:

• 7+ years of experience in DevOps, Platform, or infrastructure engineering, including at least 4 years focused on security (DevSecOps, Cloud Security, or Security Engineer);
• Hands‑on experience with both SOC2 and ISO27001: preparing for, passing, or maintaining audits, understanding the requirements behind each control, and working with auditors;
• Strong hands‑on experience with AWS and infrastructure as code using Terraform;
• Proven experience finding and fixing vulnerabilities and handling security incidents;
• Experience leading engineers or acting as a technical lead;
• AWS Professional‑level certification (a security‑focused Associate certification may also be considered);
• Upper‑Intermediate (B2+) English or higher; Fluent Ukrainian;
• Backend development background (Node.js/TypeScript, Java, C#/.NET, Go, or Python), or a career path from backend to DevOps/Platform to Security;
• Experience with CASA assessments;
• Experience implementing GDPR and/or CCPA (CPRA) requirements;
• Understanding of HIPAA or PCI DSS;
• Other security certifications (CISSP, OSCP, CKS) or GCP certifications.

Why It’s Worth Joining Us:

Security ownership at one of the world’s leading AI companies: Zeely is #22 in a16z’s Top50 consumer AI apps by monthly revenue; Security is a strategic priority for the company: a direct line to the C-level co-founders, real authority over technical decisions, and a strong voice in how the product is built; Work with cutting‑edge technologies and AI‑powered tools; A strong team of A‑level players who push each other to grow; A remote‑first setup with offices in Warsaw and Kyiv; Regular performance reviews to keep your growth transparent and rewarded.

Recruitment Process:

Intro Call -> Technical Interview -> Final Interview -> Reference Check -> Offer.