Being a Lead Security Engineer at balena
Our users trust us to provide critical infrastructure for their distributed IoT fleets, and our engineers work hard to protect each of these devices from attacks. Our “security stack” spans from the bootloader and OS on-device, to the network and security infrastructure of our backend, to the operational security of our team.
As a Lead Security Engineer, you will learn how our complex interdependent systems are built and run. You will dig deep into diagnostics & debugging surfaces, logs, and reports to identify areas of risk and strategies to minimize vulnerabilities. You will develop and deploy security controls and concepts stretching from cloud-based apps to systems running on embedded devices, and lead initiatives to create new frameworks and roadmaps. You will influence infrastructure and product decisions and, above all, establish and promote a culture of shared responsibility for security.
Responsibilities
Analyze weaknesses and attack patterns, and architect solutions to address them
Construct a comprehensive threat model that includes a variety of actors and security contexts
Define standards and streamline workflows for managing incidents, recovery, and vulnerability reports
Implement, tune, and enhance security auditing, monitoring, and notification systems
Perform checks to ensure our production pipeline is secure — from developer machines to servers
Design and review security-related product features, like automated vulnerability scanning and audit logs
Be a key resource for peers on support, share knowledge and mentor others on best practices
Requirements
Strong technical background in software development, operations and/or information security
Experience writing high-quality code and debugging production systems
Working knowledge of Linux operating system internals
Awareness of classic and emerging threat actor tactics, techniques, and procedures in both pre- and post-exploitation phases of attack lifecycles
Ability to manage ambiguity, push through friction, and independently make critical trade-off decisions
Continuous improvement mindset and desire to make yourself and others more effective
Willingness to constantly build on your knowledge of the platform and new technologies
Excellent communication skills and fluency in English
Bonus points
Proficiency in at least one high-level language (we use Typescript and Javascript)
Knowledge of state of the art authentication standards such as OIDC
Good understanding of networking (TCP/IP) and higher-level HTTP & TLS protocols
Background in leading teams and working across functions to build secure products
Experience with IoT, embedded SW, dev tools, or balena as a user/contributor
Contributions to OSS projects and community involvement
Make sure to let us know if any of these items apply to you! If possible, please also share a sample of your work or examples of projects (URL or attachment).
