Senior Security Engineer

About the role

Kestra runs arbitrary, user-defined code at scale. That is an unusually rich attack surface, and securing it is a genuinely hard engineering problem rather than a checklist exercise. You would be our first dedicated security hire. We're looking for a Senior Security Engineer to own and elevate the end-to-end security posture of our platform, infrastructure, and open-source ecosystem.

What you'll do

• Conduct hands-on penetration testing and threat modeling across our web application, APIs, control plane, and cloud environments
• Manage end-to-end vulnerability tracking across our codebases, software dependencies (SCA), container images, and cloud infrastructure
• Audit and harden our cloud infrastructure (GCP, Kubernetes clusters, and networking configurations) against external and internal threats
• Automate security tooling into our CI/CD pipelines (SAST, DAST, dependency scanners) to catch CVEs before code reaches production
• Perform security code reviews and evaluate third-party dependencies, open-source integrations, and supply-chain risks

What you need

• 5–9 yrs of experience
• Penetration testing
• Cloud security
• GCP
• Kubernetes
• Docker
• AWS
• Any graduate

Good to have

• Incident response
• CI/CD
• Elasticsearch
• PostgreSQL
• Git
• Terraform