Principal Security Engineer

Code for America believes government can work for the people, by the people, in the new digital age, and that government at all levels can and should work well for all people. For more than a decade, we’ve worked to show that with the mindful use of technology, we can break down barriers, meet community needs, and find real solutions.

Our employees build and transform government and community tools and services, making them so good they inspire change. We merge the best parts of technology, nonprofit, and government to help support the people who need it most. With a focus on diversity, equity, inclusion, and deep empathy for partners in government and community organizations and the people that our partners serve, we’re building a movement of motivated change agents driven by meaningful results and lasting impact. At Code for America, you contribute to exciting work while learning and developing in a supportive and flexible environment. Our compensation and benefits are holistic and thoughtfully curated to represent our employees and our mission. Help us drive real generational change that lasts.

Code for America is looking for a talented Principal Security Engineer to join our security practice and ensure that all our products meet a high standard of security, and we have the appropriate privacy protections in place.

As of October 27, 2023, Code for America has reached a CBA (collective bargaining agreement) with Code for America Workers United, affiliated with OPEIU (Office Professional Employees International Union, Local 1010). This position is not designated as part of Code for America Workers United.

About the Role: 

In this role, you will work with our Product Engineering and DevSecOps teams as a contributing engineer, in order to gain a deep understanding of our technical systems and identify the most impactful opportunities to improve our overall security and privacy posture.  You will also spend time stepping back from product work to evaluate our organizational practices and security compliance as a whole, establish security and privacy policies and best practices, and serve as an advisor across teams for any security and privacy issues as they arise. 

This role requires experience with both proactive (prevention) and reactive (detection and response) security work.

This position is full-time, based in our office in San Francisco or remote and reports to a Director of Engineering.

In this position you will:

• Lead Security Initiatives: Take charge of major security projects or initiatives within the organization, setting goals, timelines, creating tickets, defining cross-portfolio technical templates, and ensuring successful implementation.
• Security Architecture and Design: Develop and oversee the implementation of security architectures for software applications. This includes designing secure coding practices, threat modeling, and ensuring the security of the entire development lifecycle.
• Threat Monitoring: Proactively identify and mitigate potential security threats. This might involve the use of tools and techniques to detect, hunt and respond to cyber threats in real-time.
• Risk Assessment and Management: Conducting comprehensive risk assessments and audits to evaluate the security posture of the organization. This includes identifying vulnerabilities, assessing potential impacts, and proposing risk mitigation strategies.
• Incident Response and Forensics: Leading the response to security incidents, including the investigation of security breaches. This might also involve conducting forensic analysis to understand the cause and impact of the breach and implementing measures to prevent future incidents.
• Policy and Compliance Oversight: Ensuring that all security practices and procedures comply with regulatory requirements. This might involve staying updated with the latest regulations and standards, such as NIST 800-53 rev5.1, SOC 2, ISO 27001, etc.
• Mentoring and Leadership: Providing guidance and mentoring to junior security team members. This includes helping them develop their skills and understanding of complex security concepts and practices.
• Interdepartmental Collaboration: Working closely with other departments, such as IT, legal, and human resources, to ensure a holistic approach to security and privacy across the organization.
• Technology Research and Adoption: Keeping abreast of the latest security technologies and trends, and evaluating their potential application within the organization.
• Stak