layiq
worthy; deserving; fitting; suitable.
A role, opportunity, or path that merits attention, time, and pursuit.
Loading LAYIQ…Job opportunity
Beacon Software
San Francisco, CA, United States; New York, NY, United States; Toronto, Ontario, Canada
Source: Beacon Software careers · View original posting
From Beacon Software's posting. “We” and “our” refer to the employer.
You will be Beacon's first dedicated application security engineer. You will set the strategy for product security and start to build the program.
Beacon's application security surface spans both Beacon's own engineering and our portfolio companies' products, each independently built with its own stack and engineering team. You will embed with the teams that own the code, whether at Beacon HQ or within a portfolio company, working inside their design reviews and planning, and own the technical roadmap for product security as Beacon grows.
This is the full remit of Application Security at Beacon. It is more than one person can cover at once. As the first member of the team, you will stand up the essentials, prioritize the highest-leverage work first, and build the rest into a roadmap.
Secure design and architecture: lead threat modeling and security architecture review for new product work and platform initiatives, and define standards for authentication, authorization, encryption, and tenant isolation.
Acquisition assessment: own the product security review of newly acquired codebases and cloud environments, establishing baseline posture, material risk, and the remediation path.
Code and security review: perform secure code review, targeting authorization and business logic flaws that automated tooling does not catch. Identify and manage the external partner who runs penetration testing against our products and infrastructure, and drive remediation of what they find.
AI security: assess AI features across our products, including agent architectures, model and tool access, delegated credentials, and the data reachable through them.
Vulnerability management: own the end-to-end program, including intake, severity, prioritization, remediation SLAs, and reporting, and drive fixes through engineering teams in a way they can sustain.
Tooling and automation: own the standard for SAST, DAST, SCA, and secrets scanning, and its integration into CI/CD across the portfolio. Build the automation that lets one person cover a multi-team portfolio, including routine fix PRs, dependency remediation, and findings routing. Own the security of any internal tools you build, including their access to credentials, source code, and production systems.
Enablement: write the secure coding standards and training that engineering teams consult before they build.
Incident response: serve as the product security expert during incidents, from investigation through remediation and postmortem.
Compliance partnership: work with GRC to produce the evidence audit and customer security review require, without letting compliance drive the security roadmap.
LAYIQ is an independent job-discovery service. This listing does not imply a partnership with or endorsement by the employer. Review the original posting for current details and availability.
Employer posted: