Senior Security Engineer

About the role

ABOUT APTIBLE   Large language models are transforming software engineering — developers can now go from idea to code faster than ever. But that just shifts complexity downstream: deployment, observability, cost, security, reliability — all of that has to scale too, and LLMs don't yet solve the problem. That's where Aptible comes in. Since 2014, our cloud delivery platform has been automating security, compliance and reliability for engineering teams whose apps handle the most sensitive data, in the most highly regulated industries. The need for a platform like Aptible has never been greater. If you're passionate about cloud infrastructure and ensuring DevOps evolves to meet the pressure of AI-assisted development — and you're excited to join a small and highly talented team — we’d love to hear from you. NEW! Aptible is part of Opti9 Technologies, a cloud solutions provider specializing in managed cloud, security, disaster recovery, and compliance. Joining forces with Opti9 gives Aptible the resources to invest more aggressively in the platform — expanding what we can deliver to the engineering teams who depend on it.   OUR COMMITMENT TO DIVERSITY AND INCLUSION We see great value in bringing together a team with different perspectives, educational backgrounds, and life experiences, and we prioritize diversity within our team. We encourage people from underrepresented backgrounds to apply. ABOUT THIS ROLE OVERVIEW In this role, you'll lead on projects that improve defense and hardening for a platform that regulated companies build their businesses on. This is a hand-on engineering role where you'll architect and build secure-by-default infrastructure, run our vulnerability management and pentesting programs, and lead incident response when things go wrong. This role reports to the Chief Information Security Officer (CISO), but will work day-to-day as a member of our Platform Engineering team, and in close collaboration all engineers at Aptible. WHAT YOU'LL DO Engineering - Architect and ship projects that make a meaningful improvements to our security posture and the security posture of our customers. These improvements span the full stack, from AWS and Docker to CloudFormation, Terraform, Ansible, Ruby, Go, Python, and TypeScript. - Leverage cutting-edge AI models and third-party tools, or build your own from scratch, to level up our security game. - Own our vulnerability management and pentesting programs end to end, finding the best ways to automate vulnerability detection and mitigation. - Join the on-call rotation as a first responder for security events, and ensure we mitigate with lasting fixes so the same issue never wakes anyone up twice. WHAT WE'RE LOOKING FOR General Experience - 5+ years of experience in engineering, with a track record of owning security-critical systems in production. - Hands on experience working on projects related to security and/or compliance. Experience with HITRUST is a plus. - You communicate extremely well. You favor communication that is clear, concise, and proactive. - Prior experience working on developer tools or platform engineering experience is a plus. Technical Expertise - You have strong engineering fundamentals and coding ability, with comfort working across the full stack on a large distributed system. - You're a thoughtful developer in at least one mainstream language, are comfortable picking up new languages or working in unfamiliar codebases. - You have hands-on experience with cloud infrastructure security (AWS strongly preferred). - You have experience leading or heavily participating in incident response. Organizational Strength - You're organized enough to run the technical portion of a compliance recertification as a project - coordinating with other engineers to collect and submit evidence by hard deadlines - without that becoming your whole job. - You don't let ambiguity or bumps in the road stop you. You can identify what's blocking you, and collaborate with other team members, sometimes cross-functionally, to get unblocked. YOU SHOULD APPLY IF - You appreciate working in a highly autonomous, trusted role, where the day to day priorities may shift. - You care about and what to be involved in what your teammates are building. You don’t want to be hyper-focused on your own isolated backlog. - You're a deeply curious problem solver, and you're not tied to a specific language or technology. - You’re an an engineer with some exposure to security and compliance, and are excited to focus on security and compliance more deeply. Alternatively, you’re in DevSecOps with meaningful security and compliance experience, have contributed production code before, and want to get more hands on with larger security-focused engineering projects. - You’re willing to help navigate understanding and communicating how written policies translate to security controls, and security controls translate to technical implementation. YOU SHOULD NOT APPLY IF - You have no prior experience writing production-ready code or have no prior exposure to security and compliance. Being less experienced in one area is fine as long as you’re interested in both, however you must have prior exposure to both. - You are interested in exclusively buying security tools to solve problems, or interested in exclusively building security tooling to solve problems. - You’re not interested in working on a complex, always on system. We run a system that is business critical to hundreds of other companies. This requires a strong eye for automation, and sometimes - ideally very occasionally - overnight response.   APTIBLE'S EMPLOYEE BENEFITS https://aptible.notion.site/Careers-at-Aptible-105509e56b4180778be1e06d47b0056c#:~:text=Aptible%E2%80%99s%20Employee%20Benefits   APTIBLE'S VALUES & PRINCIPLES https://aptible.notion.site/Careers-at-Aptible-105509e56b4180778be1e06d47b0056c#:~:text=Aptible%E2%80%99s%20Values%20%26%20Principles ---- WHY APTIBLE Aptible has been around for over a decade. We have a real product, real customers who depend on it, and a profitable business. We're not a rocketship chasing hypergrowth — we're a small, tight-knit team doing meaningful work in a complex system. Together, we wield genuine ownership to drive lasting impact: the kind where our work shapes the whole product, not just a corner of it. We'll be honest: this isn't an “everything is figured out” moment. We're navigating real change, with more on the way — and we're doing it together. We're not looking for someone who thinks they have all the answers already. We're looking for someone who wants to find them with us. What keeps us here is each other. We're a team that genuinely cares — about the work, the customers (and the cool things they're building), and each other. If you want to do hard things alongside people you actually like and respect, and leave a lasting mark on a system that matters, this is that place. INTERVIEW PROCESS We want to make the experience of interviewing with us as delightful, efficient, fair, respectful, and transparent as possible. A typical process at Aptible might include the following steps. Please note that this may vary by role, and details will be provided to you early on in the process. - Introduction to Aptible with the Hiring Manager - 2-3 Skills-Based Interviews with Aptible Team Members - Take-Home Project (You will be compensated for completing this) - References - Final in-person onsite If you have a disability or special need that requires accommodation, please let your Recruiter and/or Hiring Manager know. AI AT APTIBLE 👉 tl;dr — Aptible is a good fit for pragmatic AI skeptics and for AI enthusiasts who are clear-eyed about its limitations and risks. We are a security and compliance company, and our primary goal is to make it easy for our customers to stay secure and compliant in the cloud. To do that thes