[Hiring] SecOps/AppSec Engineer @Ladder

Role Description

We are looking for a cybersecurity unicorn. A Security Engineer / Analyst who brings a rare blend of application security engineering and risk management maturity. In this role, you will be the driving force behind our vulnerability management lifecycle, balancing day-to-day security operations with development-facing vulnerability management and compliance.

Your primary mission will be embedded within our development lifecycles, taking ownership of application security vulnerability management for our engineering teams. Because our backend infrastructure runs heavily on Clojure, you won't just be running automated scanners; you will actively look at code and leverage your functional programming experience to strengthen our shift-left security philosophy. Beyond AppSec, you will wear multiple hats:

• Monitoring our cloud infrastructure and responding to alerts
• Conducting security risk reviews
• Supporting compliance audits
• Ensuring our day-to-day workspace remains locked down

The ideal candidate is well-rounded and has the ability to interact with all levels of management and external auditors, and operate effectively in a rapidly scaling, dynamic environment. We are looking for someone who is organized, self-motivated, has excellent problem-solving and writing skills, and enjoys working with people in a challenging and fast-paced environment.

What You’ll Do

• Secure the Code (Primary): Partner directly with development teams to champion application security vulnerability management. You will triage vulnerabilities within a high-scale Clojure ecosystem and assist with remediation code fixes.
• Security Ops: Configure, fine-tune, and monitor our cloud security posture leveraging Security Operations tools (SIEM, SOAR, CSP, CNAPP) to detect and respond to threats in real time.
• Champion Governance & Risk: Conduct thorough Security Reviews and risk assessments on internal architecture, third-party vendors, and APIs to ensure alignment with our corporate risk tolerance and compliance standards.
• Protect the Workspace: Maintain and optimize our day-to-day corporate workspace security, ensuring identity access management, device compliance, and productivity tools are highly secure yet frictionless for the team.
• Drive Technical Excellence: Act as a security advocate across teams. Mentor engineers on secure coding practices, establish secure defaults, and make practical risk decisions that scale with our growth.

Qualifications

• 4+ years of software engineering and/or cybersecurity experience, backed by a strong foundation in Computer Science, Cyber Security, or a related field.
• Hands-on experience coding in Clojure and working within the JVM environment.
• Hands-on experience securing modern cloud infrastructures, as well as experience working incident response.
• Thrive in dynamic environments and design security frameworks that prevent entire classes of vulnerabilities.
• Hold baseline certifications such as CompTIA Security+ or equivalents; advanced credentials like the CISSP are highly preferred.

Technologies Used

• Backend & Code: Clojure, JVM, TypeScript, JavaScript
• Cloud & Infrastructure: GCP, Kubernetes, Docker, Terraform, GraphQL
• Security & Data Operations: Google Security Command Center, Chronicle, Datomic, BigQuery, Kafka

Benefits

• Excellent medical, dental, and vision coverage for you and your family.
• Flexible paid time off, including a week-long winter holiday closure.
• Competitive stock option packages.
• 401k match program, matching up to 4% of your contributions.
• Ladder Fit Program with a monthly stipend for wellness-related expenses.
• Ten weeks of paid parental leave for all parents.
• Work-from-home flexibility and support with stipends for remote office costs.
• Fun company-wide events to foster team bonding.