Security Engineer

About the role

We are looking for a Security Engineer to own the security posture of our entire stack, from the Supabase application layer to AWS infrastructure. As the first security hire, you will work hands‑on to design, implement and maintain security controls across cloud and application environments.

Key responsibilities

• Design and enforce IAM policies, VPC security groups, and least‑privilege access on AWS.
• Conduct threat modelling and security reviews of the Supabase app architecture before and after migration.
• Implement SAST/DAST tooling and integrate security gates into CI/CD pipelines.
• Perform vulnerability scanning, patch management, and maintain incident response playbooks.
• Ensure compliance with GDPR and SOC 2 where applicable and manage secrets using AWS Secrets Manager or Vault.
• Define and maintain a penetration‑testing schedule with third‑party providers.

Required profile

• Minimum 5 years of experience in application or cloud security engineering.
• Deep expertise with AWS security services (IAM, GuardDuty, Security Hub, WAF).
• Proven experience securing Node.js/web application stacks.
• Hands‑on knowledge of the OWASP Top 10 and remediation techniques.
• Familiarity with infrastructure‑as‑code security scanning tools such as Checkov or tfsec.
• AWS Security Specialty certification or CISSP is a strong plus.

Required skills

• AWS IAM
• AWS GuardDuty
• AWS Security Hub
• AWS WAF
• Snyk
• HashiCorp Vault
• Terraform
• OWASP ZAP
• Supabase
• Node.js
• SAST
• DAST
• CI/CD pipelines
• Checkov
• tfsec