Senior Security Engineer

GiveCampus is the world's leading fundraising platform for non-profit educational institutions, committed to advancing the quality and accessibility of education. They are seeking a Senior Security Engineer to lead security initiatives and make technical decisions that shape the company's future.

Responsibilities:

• Lead secure design, architecture review, and threat modeling for applications: including web services, APIs, microservices, serverless, mobile, etc
• Lead secure design and review for infrastructure/cloud: AWS VPCs, subnets, security groups, routing, NAT, VPN, identity & access (IAM, roles, federated identities), compute/storage services (EC2, EKS, Lambda, S3, RDS), infrastructure-as-code (IaC)
• Develop and apply application security controls: code review guidance, static/dynamic analysis, runtime monitoring, penetration testing, dependency management
• Develop and apply cloud infrastructure security controls: guardrails for IaC templates (Terraform/CloudFormation), drift detection, deployment pipelines, logging/monitoring (CloudTrail, Config, GuardDuty, VPC Flow Logs). Experience setting up AWS Security Hub is preferred
• Proficiency with Cloudflare configuration, rate limiting, and WAF/DDoS features
• Experience working with compliance monitoring tools such as Vanta
• Automate security workflows across both app and infra domains: build tooling, integrate into CI/CD, implement remediation pipelines, build detection and alerting around misconfigurations or suspicious behavior
• Collaborate closely with DevOps/SRE/CloudOps/Architecture teams to embed security early (shift-left) in both app and infra lifecycles
• Stay current on emerging threats, AWS service changes, application and infrastructure attack surfaces and propose enhancements to our security strategy

Requirements:

• Bachelor's degree in Computer Science, Cybersecurity or related, or equivalent work experience
• 10+ years of hands-on experience in application security and/or infrastructure/cloud security, preferably covering both
• Strong practical experience securing applications (threat modelling, secure design, code review, pen testing) and cloud infrastructure (VPCs, compute/storage, IAM, networking)
• Proven experience in AWS: securing AWS services such as EC2, Lambda, EKS, S3, RDS, VPC, IAM
• Experience with infrastructure-as-code (IaC) tools (Terraform, CloudFormation), security automation, and embedding security into deployment pipelines
• Deep understanding of networking/security fundamentals: TCP/IP, HTTP/S, DNS, routing, firewalls, segmentation, zero-trust, VPN/NAT, etc
• Strong scripting/automation skills in one or more languages (e.g., Python, Go, JavaScript/TypeScript) for building security tooling
• Excellent communication skills: capable of influencing across teams, conveying complex security topics to technical and non-technical stakeholders
• Experience setting up AWS Security Hub is preferred
• Experience working with compliance monitoring tools such as Vanta
• Security certifications such as CEH