Security Engineer Two, Product & Cloud Security

Summary

Join HashiCorp as a Security Engineer II and contribute to the security of their cloud, self-managed, and community product portfolio. You will work closely with Research & Development teams to prioritize security features and bugs, monitor threats and vulnerabilities, and act as a subject matter expert in various information security areas. This role requires 5+ years of security experience and expertise in areas like modern programming languages, cloud environments, security design, and testing methodologies. HashiCorp offers a remote work environment and values diversity and equal opportunity.

Requirements

• Experience with a modern programming language like GO or Python
• Modern engineering practices, processes, and tools, particularly related to the Go programming language and ecosystem
• Product and service architectures in modern, multi-tenant cloud environments (IaaS, SaaS, PaaS)
• Amazon Web Services (AWS), Microsoft Azure, and/or Google Cloud Platform (GCP)
• Security design / architecture and threat modeling
• Application and infrastructure security testing methodologies and tools
• Vulnerabilities (old and new), and options for defense / mitigation
• Product vulnerability management lifecycle
• Working with and/or supporting product engineering teams

Responsibilities

• Contribute to secure architecture and design of HashiCorp products, across our cloud, self-managed, and community product portfolio
• Work across various R&D teams to prioritize security features and bugs, and ensure implementation and mitigations
• Monitor threats and vulnerabilities impacting HashiCorp products and services; triage reported vulnerabilities, identify mitigations and assess/communicate associated risk
• Act as SME in multiple information security areas (e.g. security architecture, application security, threat modeling, data protection,  etc.)
• Develop internal tooling to address security problem areas
• Contribute to the development of security solutions across the product life-cycle, such as standalone security tools, CI/CD pipeline integrations, product security features/fixes, etc

Preferred Qualifications

• Cryptography and cryptographic primitives desired
• Strong written and verbal communication skills
• Knowledge of application security topics
• A pragmatic approach to security
• The ability to empathize with engineers and product managers across the company