- Threat model new features and critical systems with product engineering teams, early enough to influence design.
- Review security-sensitive code changes, focusing on authorization, customer-data access, and payment flows.
- Build and maintain shared security tooling and CI/CD checks, including exposed-secret and vulnerable-dependency checks.
- Automate vulnerability management and establish cloud security guardrails in the AWS environment with the Infrastructure team.
- Strengthen product and staff sign-in and account security against account takeover attempts and bots.
- Own the engineering side of compliance programs, starting with SOC 2, and automate controls and evidence collection where possible.
- Lead technical responses to security incidents and provide facts and timelines for regulatory reporting.
- Improve logging and detection, and run tabletop and purple-team exercises and scope penetration tests.
- Help engineers identify and fix security issues through reviews, pairing, and short sessions.
AWSTypeScript