Staff Security Engineer (Product & Cloud)

UpGuard

3d • Remote

About The Position

UpGuard is hiring its first dedicated product security engineer to define and scale product security standards, tooling, and practices across its products and infrastructure. This Staff-level individual contributor role has significant ownership and autonomy, with responsibility for shaping the security roadmap and influencing product and platform engineering teams.

The role spans product security and production environments, including security reviews, vulnerability management, and detection and response in cloud-native infrastructure. The engineer will help embed security into the software development lifecycle, CI/CD pipelines, and production systems. Initial priorities include making threat modelling and security reviews a standard part of shipping, evaluating and implementing useful AI applications in application security, and hardening GCP and Kubernetes baselines with secure-by-default infrastructure-as-code configurations.

UpGuard is a fully remote company with optional offices in Sydney and Hobart and no mandatory office attendance. The engineering culture emphasizes iteration, collaboration, speed, pragmatic trade-offs, and a no-ego approach.

Requirements

• At least 7 years of experience in security engineering, software engineering, and/or security operations, including work in cloud environments.
• Cloud security experience; GCP is preferred, while AWS or Azure experience is also welcome.
• Experience with cloud-native Kubernetes services such as EKS, GKE, or AKS, and strong container security principles.
• Strong understanding of securing IAM and cloud identities.
• Experience leading technical security reviews of products and architectures, conducting threat modelling, and translating findings into implementable security controls.
• Strong knowledge of common web application vulnerabilities and prevention, including OWASP Top 10 and similar guidance.
• Hands-on experience with infrastructure as code and related tools, preferably Terraform or OpenTofu.

Nice To Haves

• Experience as the first security hire or a founding member of a security function at a scaling company.
• Familiarity with AI/LLM security risks, such as the OWASP LLM Top 10, and experience securing AI-powered product features.
• Strong backend engineering skills, particularly in Go.
• Experience supporting SOC 2 or ISO 27001 audits from an engineering perspective.
• Public security research, CVEs, open-source security tooling, or conference talks.
• Offensive security skills and the ability to validate findings through hands-on exploitation.

Responsibilities

• Lead threat modelling and security reviews across the product portfolio and cloud infrastructure, identifying attack vectors and designing scalable mitigations.
• Build automation, policy-as-code, and AI-driven security tooling that embeds security across the software development lifecycle and helps engineering teams shift left.
• Evaluate and implement useful AI applications in application security, including code review, triage, and coverage.
• Design and implement secure-by-default configurations for cloud and Kubernetes infrastructure.
• Own vulnerability management end to end: assess and prioritize issues by risk, coordinate remediation with engineering teams, and build preventative software supply-chain controls from development through production.
• Build scalable detection and response systems, triage alerts, and manage incidents end to end.
• Partner with product engineering and platform teams to help them deliver secure-by-design solutions.
• Define security standards, practices, and the product security roadmap as UpGuard scales.

Benefits

• Work-from-home setup allowance during the first three months.
• Monthly lifestyle subsidy for financial, physical, and mental well-being.
• US$1,500 annual Learning & Development allowance.
• Paid time off plus two additional UpGuardian leave days.
• 18 weeks of paid parental leave, irrespective of parenting role.
• Personal leave allowance, including sick and carer's leave.
• Fully remote working environment, with optional offices in Sydney and Hobart and no compulsory attendance.
• Top-spec laptops for all team members.
• Paid subscriptions to generative AI tools.
• Stock options.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed