Head of Security Engineering

Digital Harbor is an innovation-driven company that develops cloud solutions and enterprise applications for organizations worldwide. The company is seeking a hands-on Head of Security Engineering to lead security across its SaaS platform, cloud infrastructure, and internal operations. The role will execute security strategy, improve security engineering and incident response capabilities, and partner with engineering and business teams to enable secure product delivery.

Responsibilities:

• Lead and mature Digital Harbor's security engineering program across product, cloud, and operational security
• Serve as the primary security partner for Engineering, Product, Infrastructure, and executive leadership
• Drive adoption of security-by-design practices throughout the SDLC
• Build practical, developer-friendly security standards and engineering guardrails
• Lead hands-on security initiatives while establishing longer-term security priorities
• Improve detection, response, and operational security capabilities
• Foster a collaborative security culture focused on enablement rather than bureaucracy
• Help shape the future security organization as the company continues to scale
• Drive security-by-design practices throughout the software development lifecycle
• Partner directly with engineering teams to improve application, API, and platform security
• Embed practical security controls into CI/CD pipelines and developer workflows
• Lead threat modeling and architecture security reviews
• Champion DevSecOps practices focused on automation and developer enablement
• Establish secure engineering standards and best practices across the organization
• Lead cloud security initiatives across AWS and/or GCP
• Define and implement scalable security controls for:
• Infrastructure as Code
• Kubernetes and containerized environments
• Cloud-native architectures
• Improve cloud security posture through automation, monitoring, and infrastructure hardening
• Partner with Infrastructure and DevOps teams to reduce operational risk without introducing unnecessary friction
• Ensure security controls scale alongside the platform
• Lead security incident response efforts with hands-on technical involvement
• Improve detection, monitoring, investigation, and response capabilities
• Drive automation that reduces manual operational effort
• Build repeatable operational security processes
• Continuously improve security controls against evolving threats
• Act as the primary leader for security engineering initiatives
• Help define and execute the company's security roadmap
• Build strong partnerships across Engineering, Product, Operations, Legal, and Leadership
• Promote security as a business enabler rather than a blocker
• Mentor engineers and advocate for secure engineering practices
• Identify future staffing, tooling, and process needs as the security program grows
• Support SOC 2 and ISO 27001 initiatives by implementing practical engineering controls that satisfy compliance requirements while maintaining engineering velocity
• Assist with vendor security reviews and technical risk assessments
• Partner with Legal and Product teams on privacy and data protection initiatives
• Maintain practical, risk-based security processes that support business growth without unnecessary bureaucracy
• Contribute to documentation, standards, and policies where appropriate

Requirements:

• 6–9+ years of progressive experience in Security Engineering, Product Security, DevSecOps, Cloud Security, Application Security, or Security Architecture
• Experience securing modern SaaS products and cloud-native applications
• Experience operating within AWS and/or GCP cloud environments
• Proven ability to partner closely with software engineering, platform engineering, and DevOps teams
• Demonstrated success leading cross-functional technical initiatives
• Experience balancing strong security outcomes with engineering velocity
• Cloud Security (AWS and/or GCP)
• DevSecOps and CI/CD Security
• Security Engineering and Automation
• Detection & Response Engineering
• Application Security
• API Security
• Vulnerability Management
• Threat Modeling
• Container and Kubernetes Security
• Builder mentality with a strong sense of ownership
• Hands-on, execution-oriented, and highly collaborative
• Comfortable operating in fast-moving, evolving environments
• Excellent communication skills with both technical and non-technical stakeholders
• Pragmatic approach to balancing security, scalability, and product delivery
• Ability to influence through collaboration rather than excessive process
• Bias toward action, continuous improvement, and measurable business impact
• Experience working within a software product company where security was embedded directly into software engineering and product development processes strongly preferred
• Experience working within a software product company (strongly preferred)
• Demonstrated history of ownership and measurable impact through meaningful tenure within previous organizations. Candidates who have successfully built and matured security capabilities over multiple years are strongly preferred
• Infrastructure as Code (Terraform preferred)
• Experience with modern security tooling and cloud-native security platforms
• Familiarity with AI security risks and emerging threat landscapes
• Experience securing modern SaaS products
• Experience supporting distributed engineering organizations
• Experience helping build or scale a security engineering function
• CISSP, CISM, or equivalent certification
• Experience in high-growth SaaS organizations
• Exposure to modern product security practices at scale