高级安全工程师
Senior Security Engineer
我们是一家约40人的公司，构建OAuth/OpenID Connect平台，大型数字银行和受监管行业在其上运行身份验证。我们的技术栈是Java在Google Cloud上，以共享多租户服务、专用单租户集群和客户自行运行的自管理产品形式交付。
这是一个亲力亲为的开发者角色，不是管理或纯合规角色。你将从零开始建立我们的安全计划：编写策略、发布代码修复、将检测机制集成到GCP，并制定其他工程团队遵循的最佳实践。你将借助AI快速推进，研究最佳公司的做法，起草策略，审查代码，并以精益团队无法达到的规模寻找漏洞。
你将负责
· 全流程搭建漏洞管理计划：包括接收、分类、严重性评估、修复目标、安全通告和协调披露，覆盖我们所有的托管和自托管部署模式。
· 建立产品安全事件响应（PSIRT）：值班制度、操作手册和AI辅助分类，能自动将High/Critical级别的CVE转化为通知事件。
· 在代码库中亲自工作，为我们的Java平台贡献安全修复，提升安全编码、密钥和秘密管理以及系统加固的标准。
· 在GCP中构建主动检测和响应机制：在有成效的地方设置警报、监控和自动化。
· 将安全集成到CI/CD和IaC中：依赖项和容器扫描，Terraform检查。
· 管理我们的外部安全态势：security.txt、安全联系人、公开的信任页面和安全白皮书。
· 通过让AI代理在其他人之前对我们的代码进行分析，提前应对前沿AI攻击工具（如Mythos类AI发现的零日漏洞）。
· 与平台工程师合作，参与安全相关的架构设计，并主导其安全维度。
· 在工程团队中实际支持ISO 27001和SOC 2控制措施，而不是成为审计管理员。
我们寻找
· 一位亲自编写代码的安全工程师。你熟悉阅读和编写代码（Java、Go是加分项）、Terraform和GCP配置，而不仅仅是审查他人的工作。
· 强大的应用安全基础：安全编码、漏洞管理、CI/CD中的安全。
· GCP、IAM、Kubernetes和基础设施加固方面的云安全深度。
· 事件响应经验：调查、检测工具和与客户或监管机构清晰的沟通。
查看英文原文
We’re a ~40 person company building the OAuth/OpenID Connect platform that large digital banks and regulated industries run their identity on. Our stack is Java on Google Cloud, delivered as a shared multi-tenant service, dedicated single-tenant clusters, and a self-managed product customers run themselves.
This is a hands-on builder role, not a management or pure-compliance role. You’ll build our security program from the ground up: writing the policies, shipping code fixes, wiring detection into GCP, and setting the practices the rest of engineering follows. You’ll lean on AI to move fast, researching how the best companies do this, drafting policies, reviewing code, and hunting vulnerabilities at a scale a lean team otherwise couldn’t reach.
What you'll do
- Stand up our vulnerability management program end to end: intake, triage, severity, remediation targets, security advisories, and coordinated disclosure, across both our managed and self-managed deployment models.
- Build our product security incident response (PSIRT): on-call, playbooks, and AI-assisted triage that turns High/Critical CVEs into paged incidents automatically.
- Work hands-on in the codebase, contributing security fixes to our Java platform and raising the bar on secure coding, secrets and key management, and hardening.
- Build proactive detection and response in GCP: alerts, monitoring, and automation where it pays off.
- Integrate security into CI/CD and IaC: dependency and container scanning, Terraform checks.
- Own our external security posture: security.txt, a security contact, a public trust page, and a security white paper.
- Get ahead of frontier-AI offensive tooling (the Mythos class of AI-discovered zero-days) by pointing AI agents at our own code before someone else does.
- Partner with platform engineers on security-relevant architecture and lead its security dimension.
- Support ISO 27001 and SOC 2 controls pragmatically alongside engineering, without the role becoming audit admin.
What we're looking for
- A hands-on security engineer who codes. You’re comfortable reading and writing code (Java, Go a strong plus), Terraform, and GCP configs, not just reviewing others’ work.
- Strong application security foundation: secure coding, vulnerability management, security in CI/CD.
- Cloud security depth on GCP, IAM, Kubernetes, infrastructure hardening.
- Incident response experience: investigations, detection tooling, and clear communication with customers or regulators.
- You’re energized by owning the whole spectrum at a small company rather than going narrow at a large one.
- Bonus: OAuth/OIDC, FAPI, or identity-security background; ISO 27001 or SOC 2 exposure.
Why Join Us
- Own security for a platform used by large financial and regulated customers
- Work closely with founders, engineering, and customers
- Modern, cloud-native environment without unnecessary overhead
- Competitive pay and flexibility
Originally posted on Himalayas