Lead Applications Security Engineer, Product (Chicago, USA)

About Copado

Copado is the #1 DevOps Platform for Salesforce and the Cloud. We harness the power of native CI/CD and Robotic Testing to drive digital transformation for 1,000 of the most innovative brands on the planet — from Coca-Cola to eBay to Volkswagen. Our low-code platform unites non-technical admins and pro-code developers on the same system and empowers enterprises to scale end-to-end software delivery across multi-cloud environments.

The impact on your business? 20X faster releases, 94% fewer production bugs and 46% more Salesforce ROI. The impact on your team? No more late nights, weekend war rooms or stressful release days.

Brief Summary Of Role

Security plays a critical role at Copado in building and protecting customer trust. We need your help scaling our security initiatives as Copado expands its product offerings to new markets and customers. You will be in charge of Product Security, and be part of a small but mighty Security team, reporting to the Head of Security.

What You’ll Be Doing

• Conduct product design reviews, threat modelling, and technical security assessments of products to identify risks and provide security guidance
• Drive Security Architecture best practices across different product lines
• Scale the impact of our team through tooling and automation
• Track and drive vulnerability remediation across our code base and cloud infrastructure
• Partner with engineering teams to integrate reproducible security practices into the product development lifecycle
• Collaborate with Product, Engineering, Legal, IT and other internal stakeholders to provide recommendations for solutions focused on decreasing business risk
• Represent product security in our ISO27001, SOC 2, and FedRAMP audits
• Author security guidelines and documentation
  
  

We Are Looking for Someone With

• Collaborative Communication: You engage and listen empathetically to others, adjusting your communication style to fit the audience and message. You are experienced in communicating with technical and non-technical audiences, leadership, internal and external parties.
• Mentoring: You enjoy using your knowledge and experience to support and uplevel those around you.
• Motivated Learner: You learn new technologies, and processes quickly, and understand where and how to look for knowledge when you need it.
• Holistic Focus: You can get into technical security issues, but you are able to consider the security landscape holistically, factoring in both the business and security context.
• Data Driven: Experience using data to inform decisions and familiarity with quantified risk.
• Deep understanding of application security best practices, and how those fit into web application architecture and design principles.
• In-depth experience identifying and protecting against web application and web service security vulnerabilities including those found in the OWASP Top 10 and CWE Top 25.
• Demonstrated experience in building or up levelling an SDLC program.
• Strong organizational skills around compiling and disseminating the right amount of information for security issues to different types of audiences.
• Relevant development experience in programming languages such as: Java, Python, JavaScript / Node.js
  
  

Nice to Have

• In-depth knowledge of the Salesforce platform, GCP, or AWS
• Experience with security and compliance frameworks (ISO 27001, SOC 2, FedRAMP)
• Public speaking engagements or published research
• Professional security certifications (e.g., OSCP, OSCE)
  
  

Copado is Equal Employment Opportunity and Affirmative Action Employers. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, or disability status. Copado does not accept unsolicited headhunter and agency resumes. Copado will not pay any third-party agency or company that does not have a signed agreement with Copado.