Senior Security Enablement Engineer

Phorest

6d•Remote

About The Position

Phorest Salon Software powers over 11,000 hair and beauty salons globally, processing millions of appointments and transactions monthly. We are expanding our security capabilities and seeking an experienced engineer to proactively enhance our security posture. This role is not about taking tickets but about taking initiative, building solutions, and partnering with product and engineering teams. You will leverage your security expertise to solve complex problems, raise the security awareness of teams, and implement scalable security tooling and processes. Your primary function will be as an enabler, embedding security into engineering culture and practices, coaching others, and sharing knowledge to elevate the security bar for the entire engineering team.

Requirements

Takes initiative, creates momentum, develops a point of view, and moves forward, keeping stakeholders informed.
Comfortable defining problems, deciding approaches, and owning outcomes.
Able to bridge technical and non-technical worlds, explaining risk clearly to diverse audiences and translating security requirements into practical engineering guidance.
Proactive growth mindset: seeks feedback, challenges the status quo, embraces ambiguity, and turns learning into action.
Demonstrable hands-on secure development experience (preferably 7+ years).
Written production code at some point in their career.
Deep experience in a security engineering or application security role to act as an SME for complex security challenges.
Comfortable using AI tools to accelerate security work.
Strong working knowledge of AWS security, IAM, GuardDuty, Security Hub, WAF, and related services.
Familiarity with common vulnerability classes, OWASP, and secure SDLC frameworks.
Comfortable working across SaaS, multi-tenant architectures.
Strong communicator (written, verbal, async).
Able to build trust with engineering teams without relying on authority.
Proactive in keeping stakeholders informed; surfaces problems early.
Comfortable working in a distributed team where outcomes are owned end-to-end.

Nice To Haves

Experience working in a payments or regulated SaaS environment (PCI DSS, GDPR, HIPAA).
Familiarity with Team Topologies or other platform/enabling team models.
Exposure to offensive security techniques, penetration testing, red teaming, or bug bounty.
Experience building security enablement or champion programs that improve security capability and ownership across an engineering organization.

Responsibilities

Own security engineering outcomes, acting as a Subject Matter Expert (SME), identifying cross-functional opportunities, and driving improvements.
Partner with engineering teams to introduce tooling that promotes secure coding practices.
Identify opportunities to improve the security experience and deliver improvements that reduce risk or friction.
Collaborate with platform engineers to integrate security into CI/CD pipelines, cloud environments, and code review workflows.
Establish reusable patterns and practices for secure-by-default approaches.
Work with engineering leads to prioritize process and tooling improvements based on the risk landscape.
Proactively identify security knowledge and capability gaps, and build confidence through collaborative threat-modeling, documentation, and hands-on pairing.
Embed with product teams at key stages (design, architecture review, pre-launch) to provide security input as a trusted peer.
Coach teams through complex security decisions to build their own capability.
Act as a trusted partner between Security and Product & Engineering, translating security and compliance requirements.
Share security learnings, emerging threats, and incident lessons across Engineering to create reusable guidance and raise awareness.
Monitor security signals and alerts, identify patterns, and build shared situational awareness.
Identify and assess emerging security risks and opportunities, conducting exploratory risk analysis to shape the security program roadmap.
Build out security requirements and review processes for the AWS-hosted, multi-tenant SaaS environment.
Contribute to the on-call rota, providing security coverage for incidents.
Support security incident response end-to-end, including triage, containment, post-incident review, and remediation tracking.