GiveCampus is the world's leading fundraising platform for non-profit educational institutions, committed to advancing the quality and accessibility of education. They are seeking a Senior Security Engineer to lead security initiatives and make technical decisions that shape the company's future.
Responsibilities:
- Lead secure design, architecture review, and threat modeling for applications: including web services, APIs, microservices, serverless, mobile, etc
- Lead secure design and review for infrastructure/cloud: AWS VPCs, subnets, security groups, routing, NAT, VPN, identity & access (IAM, roles, federated identities), compute/storage services (EC2, EKS, Lambda, S3, RDS), infrastructure-as-code (IaC)
- Develop and apply application security controls: code review guidance, static/dynamic analysis, runtime monitoring, penetration testing, dependency management
- Develop and apply cloud infrastructure security controls: guardrails for IaC templates (Terraform/CloudFormation), drift detection, deployment pipelines, logging/monitoring (CloudTrail, Config, GuardDuty, VPC Flow Logs). Experience setting up AWS Security Hub is preferred
- Proficiency with Cloudflare configuration, rate limiting, and WAF/DDoS features
- Experience working with compliance monitoring tools such as Vanta
- Automate security workflows across both app and infra domains: build tooling, integrate into CI/CD, implement remediation pipelines, build detection and alerting around misconfigurations or suspicious behavior
- Collaborate closely with DevOps/SRE/CloudOps/Architecture teams to embed security early (shift-left) in both app and infra lifecycles
- Stay current on emerging threats, AWS service changes, application and infrastructure attack surfaces and propose enhancements to our security strategy
Requirements:
- Bachelor's degree in Computer Science, Cybersecurity or related, or equivalent work experience
- 10+ years of hands-on experience in application security and/or infrastructure/cloud security, preferably covering both
- Strong practical experience securing applications (threat modelling, secure design, code review, pen testing) and cloud infrastructure (VPCs, compute/storage, IAM, networking)
- Proven experience in AWS: securing AWS services such as EC2, Lambda, EKS, S3, RDS, VPC, IAM
- Experience with infrastructure-as-code (IaC) tools (Terraform, CloudFormation), security automation, and embedding security into deployment pipelines
- Deep understanding of networking/security fundamentals: TCP/IP, HTTP/S, DNS, routing, firewalls, segmentation, zero-trust, VPN/NAT, etc
- Strong scripting/automation skills in one or more languages (e.g., Python, Go, JavaScript/TypeScript) for building security tooling
- Excellent communication skills: capable of influencing across teams, conveying complex security topics to technical and non-technical stakeholders
- Experience setting up AWS Security Hub is preferred
- Experience working with compliance monitoring tools such as Vanta
- Security certifications such as CEH