Security Engineer

About the role

We are looking for a hands‑on Security Engineer to own the security posture of our entire stack, from the Supabase application layer to the underlying AWS infrastructure. As the first security hire, you will shape the security strategy and work directly with development and operations teams.

Key responsibilities

• Design, implement and enforce IAM policies, VPC security groups, and least‑privilege access controls on AWS.
• Conduct threat modelling and security reviews of the Supabase architecture before and after migration.
• Integrate SAST/DAST tools and security gates into CI/CD pipelines.
• Run vulnerability scanning, manage patch cycles, and maintain incident‑response playbooks.
• Ensure GDPR and SOC‑2 compliance, manage secrets with AWS Secrets Manager or HashiCorp Vault.
• Define and coordinate regular penetration‑testing activities with third‑party providers.

Required profile

• 5+ years of experience in application or cloud security engineering.
• Deep expertise with AWS security services (IAM, GuardDuty, Security Hub, WAF).
• Proven experience securing Node.js/web application stacks.
• Hands‑on knowledge of the OWASP Top 10 and remediation techniques.
• Familiarity with IaC security scanning tools such as Checkov or tfsec.
• AWS Security Specialty or CISSP certification is a strong plus.

Required skills

• AWS (IAM, GuardDuty, Security Hub, WAF)
• Supabase
• Node.js
• SAST/DAST tools (e.g., Snyk, OWASP ZAP)
• HashiCorp Vault
• Terraform
• CI/CD pipeline security
• Vulnerability scanning and patch management
• Incident response and pen‑testing coordination
• GDPR / SOC‑2 compliance