Senior Security Engineer - Remote, Open-Source Security

Kestra Technologies; United States; Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Health coverage

Home office setup

Job summary

Kestra is seeking a Senior Security Engineer to own and elevate the end-to-end security posture of the platform, infrastructure, and open-source ecosystem. This hands-on role blends breaking systems to find vulnerabilities with actively fixing them and guiding remediation across teams.

You will secure web apps, APIs, control planes, and cloud environments (GCP, Kubernetes). Deep expertise in CI/CD security, SCA, and supply-chain risk is essential for a remote-first, fast-paced startup.

Qualifications

• 5+ years of experience in Security Engineering, Product Security, DevSecOps, or a combined Offensive/Defensive role.
• Proven hands-on penetration testing with ability to discover vulnerabilities in apps, APIs and networks.
• Builder/fixer mindset: can read code, understand exploits, and fix issues or provide remediation steps to engineers.
• Deep familiarity with cloud security (AWS or GCP) and containerized environments (Kubernetes, Docker).
• Experience with dependency and supply-chain security (CVE management, open-source licensing, SCA tools).
• Fluent in English and able to work autonomously in a fully remote environment.

Responsibilities

• Conduct hands-on penetration testing and threat modeling across web apps, APIs, control plane, and cloud environments.
• Manage end-to-end vulnerability tracking across codebases, dependencies, containers, and cloud infra.
• Proactively fix security flaws by writing patches, submitting PRs, and guiding remediation with Product teams.
• Harden cloud infra (GCP, Kubernetes, networking) against external and internal threats.
• Automate security tooling in CI/CD (SAST, DAST, dependency scanners) to catch CVEs before production.
• Perform security code reviews and evaluate third-party dependencies and supply-chain risks.
• Lead incident response efforts and establish continuous monitoring, detection, and mitigation strategies.
• Own public security posture: disclosure process, CVE handling, advisories, and trust model for plugin ecosystem.

Skills

Penetration testing

Threat modeling

Cloud security

Kubernetes

Docker

Open-source security

Code reading & remediation

Fluent English

Tools

Trivy

Dependabot

GitHub Actions

Docker

Kubernetes

Terraform

GCP

Job description

Kestra is seeking a Senior Security Engineer to own and elevate the end-to-end security posture of the platform, infrastructure, and open-source ecosystem. This hands-on role blends breaking systems to find vulnerabilities with actively fixing them and guiding remediation across teams.

You will secure web apps, APIs, control planes, and cloud environments (GCP, Kubernetes). Deep expertise in CI/CD security, SCA, and supply-chain risk is essential for a remote-first, fast-paced startup.