Senior SecOps Engineer

withclutch; United States; Remote; USD 83,000 - 165,000; Full time

Benefits offered by this job

Remote work

Paid time off 20 days

Stock options

Home office allowance

Travel & coworking budget

Twice-yearly team off-sites

Job summary

withclutch is seeking a hands-on Application and Cloud Security Engineer to lead security across software, infrastructure, and engineering workflows. You will partner with developers to bake secure design into delivery, reduce vulnerabilities, and strengthen security practices as systems evolve.

You will assess risks in applications and cloud accounts, advise on secure architecture and threat models, and integrate SAST/DAST/SCA into CI/CD.

Qualifications

• Minimum five years in application or software security.
• Experience embedding security tools in CI/CD pipelines.
• Familiarity with SOC 2, GLBA, PCI-DSS; AWS or GCP experience.

Responsibilities

• Assess security risks across applications, cloud accounts, and delivery pipelines.
• Advise on secure architecture and threat models for features, services, and cloud changes.
• Integrate code, dependency, secrets, and infrastructure scanning into CI/CD workflows.
• Establish secure development practices, security gates, and clear ownership throughout the software lifecycle.
• Improve cloud protections through least-privilege access, secrets management, threat detection, policy as code, and drift monitoring.
• Develop security automation, incident response guidance, shared secure libraries, and an engineering security champion network.

Skills

Web security

API security

Threat modeling

CI/CD security

Node.js

Python

Go

Communication

Tools

SAST

DAST

SCA

Infrastructure scanning

Job description

Role overview

Lead hands-on application and cloud security work across software, infrastructure, and engineering workflows. Partner with developers to make secure design part of delivery from the start, reduce vulnerabilities, and strengthen security practices as systems evolve.

Responsibilities

• Assess security risks across applications, cloud accounts, and delivery pipelines; prioritize remediation with engineering teams.
• Advise on secure architecture and threat models for features, services, and cloud changes.
• Integrate code, dependency, secrets, and infrastructure scanning into CI/CD workflows.
• Establish secure development practices, security gates, and clear ownership throughout the software lifecycle.
• Improve cloud protections through least-privilege access, secrets management, threat detection, policy as code, and drift monitoring.
• Develop security automation, incident response guidance, shared secure libraries, and an engineering security champion network.

Requirements

• At least five years of experience in application or software security.
• Strong knowledge of web and API security, secure software design, and threat modeling.
• Experience embedding security tools and practices in CI/CD, including SAST, DAST, SCA, and infrastructure scanning.
• Familiarity with cloud security and compliance frameworks such as SOC 2, GLBA, or PCI-DSS; AWS or GCP experience is relevant.
• Coding experience in languages such as Node.js, Python, or Go, with the ability to review and debug application code.
• Clear communication and the ability to influence and work across engineering teams.

Benefits and work setup

The position is offered on a contractor basis and supports remote work. The package includes 20 days of paid time off, national holidays, stock options, a home office allowance, a work travel and coworking budget, and twice-yearly team off-sites. Applicants need existing authorization to work in the job’s country; visa sponsorship is unavailable.