Cloud Security Engineer

EquipmentShare is hiring a Cloud Security Engineer

EquipmentShare is searching for a Security Engineer for the Cloud Operations team.  As a Security Engineer, you will help ensure that new and existing cloud infrastructure is designed and implemented in a way that follows community preferred security practices as well as respond to security related incidents helping to resolve the issue, perform forensics and impact analysis, write post-mortems, and provide guidance for short and long term remediation.  You will also help us design and implement policies, procedures, and runbooks for incident response as well as helping to develop security guidelines for software development teams.  The ideal candidate will have a broad understanding of software development practices, experience with Amazon Web Services (AWS), familiarity with various security related compliance standards, and 4+ years of experience in the field.

Your role in our team

At EquipmentShare, we believe it’s more than just a job, we invest in our people and encourage you to choose the best path for your career. It’s truly about you, your future and where you want to go. We are looking for a Security Engineer to help us continue to build the next evolution of our platform in a secure, scalable, performant and customer-centric oriented architecture. Our main tech stack includes : AWS, Managed Kubernetes (EKS), Python, Aurora RDS PostgreSQL, DynamoDB, Kafka, Kinesis, React, Node.js, and Typescript. We currently implement security, alerting, and monitoring tools including AWS GuardDuty, AWS WAF, Lacework cloud-native application protection platform, DataDog, and PagerDuty.

What you'll be doing

We are typically organized into agile cross-functional teams composed of Engineering, Product and Design, which allows us to develop deep expertise and rapidly deliver high value features and functionality to our next generation T3 Platform.

As a Security Engineer, you will…

• Work with domain teams of software engineers who are dispersed across the United States and the United Kingdom.
• Design, develop, deploy, and maintain security automation, secure-by-default solutions that will enable developer and security engineering productivity using scripting or programming languages.
• Design and develop security policies and procedures following community preferred practices with an eye towards future compliance with standards such as SOC 2, and Federal Acquisition Regulation (FAR).
• Own, coordinate, and participate in incident response, remediation and triage campaigns taking on periodic on-call responsibilities.
• Develop, document, and implement runbooks for incident response to help streamline remediation.
• Produce incident post-mortem documentation for a variety of audiences including technical and non-technical stakeholders.
• Research and interpret vulnerability disclosures and intelligence.
• Perform security reviews including secure design and architecture, threat modeling, threat assessments, secure code reviews, and security testing.
• Identify security gaps in applications, services, and products including internally developed and third party solutions.
• Contribute to the long-term and short-term security strategy to ensure that applications are designed and built securely.
• Comfortably transition between big picture, strategic thinking and tactical day-to-day operational execution.
• Influence decision-makers and stakeholders to achieve a consistently high security bar.
• Evaluate and recommend new and emerging security products and technologies.

We'll be there to support you as you become familiar with our teams, product domains, tech stack and processes — generally how we all work together.

Who you are

You're hands-on - you enjoy solving complex problems and building impactful solutions.  Most importantly, you care about making a difference.

• Take the initiative to own outcomes from start to finish — knowing what needs to be accomplished within your domain and how we work together to deliver the best solution.
• You h