[Hiring] Security Engineer @DISCO

Role Description

As DISCO grows, we’re investing further in security by creating a dedicated Security Engineer role. You’ll build on the strong foundations our engineering team has established as a SOC 2-compliant SaaS company in the music industry, and help shape how our security program evolves and scales.

This role will work with security end-to-end at DISCO:

• Internal and application security
• Cloud infrastructure
• Detection and response
• Compliance

You will collaborate directly with engineering, product, legal and leadership, setting standards, assisting to harden our systems and build out the monitoring and processes that keep our platform and our customers' data safe.

If you are passionate about real security and you want to be the person who writes the playbook rather than follows one, this role is for you.

What You'll Do

• Application Security
  • Lead security engineering for our Python/Django/React application, including code reviews, threat modelling, and security design reviews for new features and existing platform components
  • Own static analysis, dependency scanning, secret scanning in CI and triage of findings
  • Coordinate penetration testing – including agentic scanning using frontier models; internal red team testing and third party testing – and drive remediation of findings
  • Partner with engineers to set secure coding standards and provide practical guidance.
• Identity and Access
  • SSO/MFA enforcement for internal tooling, on and offboarding processes and access reviews
  • Secure, auditable staff platform access
• Cloud and Infrastructure Security
  • Collaborate with our Platform team to secure our AWS environment: IAM, network architecture, secrets management, and compute/data layer hardening
  • Define and automate security baselines for infrastructure, including container security and CI/CD pipeline integrity
  • Lead secure architecture reviews for new systems and significant infrastructure changes
• Detection and Incident Response
  • Build and maintain detection capabilities across our application, cloud, and SaaS stack, including anomaly detection and alerts
  • Manage security incident response: triage, containment, investigation, stakeholder communication, and post-incident review
  • Develop runbooks and response playbooks so that when incidents happen, we are ready
• Security Compliance and Risk
  • Contribute to our SOC2 compliance program, including evidence collection, control monitoring, and audit readiness
  • Conduct vendor and customer security assessments
  • Communicate security risks clearly to engineering and leadership, and drive prioritisation of remediation work
  • Contribute to keeping security policies and documentation current and fit for purpose
• Security Leadership
  • Define the security roadmap, assessing priority based on impact and risk
  • Act as a voice for security in architecture decisions
  • Mentor engineers and other staff on security and build a security first culture
  • Report on security posture to leads and other departments
  • Advise and contribute to internal IT and physical security initiatives

Qualifications

• 7+ years in engineering and 5+ years of hands-on security experience in a product security, application security, or security engineering role
• Experience with threat hunting, threat intelligence, or red team activities
• Strong Python/Django application security knowledge
• Solid AWS cloud security experience covering IAM, network controls, and secure architecture patterns
• Practical incident response experience including experience being on call
• Working knowledge of SOC2 or a comparable compliance framework
• The ability to communicate risk clearly to both technical and non-technical audiences
• Comfort working autonomously in a remote, cross-timezone environment

Bonus Points

• Experience building a security program at a scaling startup
• Familiarity with the music industry or B2B SaaS, including specific audio technologies like HLS
• Relevant certifications: OSCP, CISSP, AWS Security Specialty, or similar

Benefits

• A competitive salary in a fast-growing startup
• Four weeks of paid vacation leave per year
• Two weeks of paid sick leave per year
• Paid Parental Leave
• A company laptop
• Monthly internet allowance/reimbursement
• Office set-up allowance
• Annual learning and development allowance
• The ability to work how you want