Senior Backend Software Engineer

GoTo Meeting; Boulder (CO); Hybrid; USD 171,000 - 202,500; Full time

Benefits offered by this job

Name Your Satellite Program (NYSP)

Generous Time Off Policy

Education Assistance Program

Employee Stock Purchase Program (ESPP)

Fitness Reimbursement

Healthy snacks & beverages in every office

Job summary

GoTo Meeting is seeking a Security Engineer in Boulder, Colorado. You will design and implement security-related software to enhance development processes. Responsibilities include integrating automation into CI/CD pipelines and contributing to compliance efforts with NIST and CMMC requirements. The ideal candidate will have over 5 years of experience in security engineering, especially with secure cloud systems, and proficiency in container security tools. Competitive salary and global perks are offered, along with a hybrid work environment.

Qualifications

• At least 3 years in security-focused roles.
• Experience with secure cloud systems and compliance efforts.
• Understanding of modern attacks and defenses.

Responsibilities

• Assist in integrating security automation into pipelines.
• Contribute to evolving standard libraries, testing and updates.
• Support on implementing controls to meet CMMC Level 2 requirements.
• Participate in security architecture reviews and code audits.
• Engage in code reviews and pair programming sessions.

Skills

Experience in software or security engineering

Proficiency in container security

Knowledge of common threats

Ability to collaborate with internal teams

Education

5+ years in software or security engineering

Relevant certifications (e.g., CSSLP, OSCP, GIAC)

Tools

Docker

Kubernetes

Security tools (e.g., Trivy, Snyk)

Python

Rust

Job description

About the Role

You'll focus on hands‑on design and implementation of security‑related software, to shift security left in our development processes. This includes embedding automated controls such as SBOMs and vulnerability scanning into CI/CD pipelines, maintaining and updating our internal shared libraries and infrastructure for authentication, authorization, and logging, and assisting with monitoring tools for operational services. Where needed, you'll help align systems with NIST 800‑171/CMMC requirements, collaborating closely with the Principal Security Engineer, AWS infra team, dev tooling team, chief software engineer, and cybersecurity/GRC group.

You’ll work in a lean, impact‑focused environment—prioritizing deliverables like secure code and architecture with bureaucracy handled by the TPM/GRC org as much as possible. Occasional engagement in security discussions with government entities may be involved, under the principal security engineer’s guidance.

~80–90% hands‑on work, with the remainder on collaboration and learning.

Key Responsibilities

• Implement Security Controls in SDLC: Assist in integrating security automation into pipelines (e.g., GitHub Actions/ArgoCD for SAST/DAST/SCA, SBOM generation, and vulnerability scanning).
• Support Shared Libraries and Infra: Contribute to evolving standard libraries/infra for authn/authz, logging, and other runtime security features, including testing and updates.
• Contribute to CMMC Compliance: Hands‑on support for implementing controls (e.g., encryption, secure configurations, monitoring) to meet or exceed CMMC Level 2 requirements in AC, IA, SC, and SI families, building on our ISO 27001 foundation.
• Assist with Reviews and Models: Participate in security architecture reviews, code audits, and threat modeling; help identify and remediate issues such as API vulnerabilities or supply chain risks.
• Team Collaboration: Engage in code reviews, pair programming sessions, and tooling development to advance secure practices; provide peer support within the security engineering team.

Required Qualifications

• Experience: 5+ years in software or security engineering, with at least 3+ years in security‑focused roles. Experience with secure cloud systems (AWS), CI/CD security, and compliance efforts (e.g., NIST, CMMC, or FedRAMP).
• Technical Expertise: Proficiency in container security (Docker/Kubernetes), security tools (e.g., Trivy, Snyk, Falco, OPA), and programming languages for tooling (Python, Rust). Understanding of modern attacks and defenses.
• Security Acumen: Knowledge of common threats (e.g., injection, lateral movement), controls (NIST 800‑53 mappings), DevSecOps practices, SBOMs, zero‑trust principles, and SIEM‑integrated logging.
• Interpersonal Skills: Ability to collaborate constructively with internal teams and contribute to external security discussions as needed.

Preferred Skills

• Familiarity with AWS security services (e.g., GuardDuty, Security Hub, Config) and IaC tools (Terraform).
• Experience with embedded or satellite security (e.g., secure boot, over‑the‑air updates).
• Contributions to open‑source security projects.
• Relevant certifications (e.g., CSSLP, OSCP, GIAC) demonstrating practical expertise.
• Proven ability to work in small, agile teams and learn from senior mentors.

Bonus

• Experience in regulated industries (defense/aerospace); clearance for sensitive data handling.

Work Requirements

Spire operates a hybrid work model, and this position will require you to work a minimum of three days per week in the office.

Access to US export‑controlled software and/or technology may be required for this role. If needed, Spire will arrange the necessary licenses—this is not something candidates need to have before applying.

Salary Range

$171,000 – $202,500 USD

Global Perks

• Name Your Satellite Program (NYSP)
• Launch Attendance
• Generous Time Off Policy
• Education Assistance Program
• Employee Assistance Program (EAP)
• Employee Stock Purchase Program (ESPP)
• Family Leave
• Fitness Reimbursement
• Employee Referral Program
• Healthy snacks & beverages in every office

Equal Opportunity Statement

We are proud to be an equal opportunity employer and are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, marital status, disability, gender identity or veteran status.