Role Overview
The Security Specialist is responsible for improving the security posture of Inventeer’s products and platforms by embedding security into architecture, engineering workflows, and delivery standards. This is a delivery-focused role: success is measured by security controls implemented, risks reduced, security issues prevented, and repeatable secure defaults—not by one-off audits or reactive firefighting. The Security Specialist partners closely with DevOps, Product Engineers, QA, and leadership to make security a normal part of how we ship.
Key Responsibilities
Secure Architecture & Engineering Guidance
- Perform threat modeling for new features and major changes; document risks and mitigations.
- Define and enforce secure patterns for authentication, authorization, data protection, and tenancy boundaries (when applicable).
- Review designs and PRs for high-risk areas; provide actionable, engineering-friendly recommendations.
Secure SDLC & Security Tooling
- Implement and maintain security checks in CI/CD (dependency scanning, SAST where appropriate, secret scanning).
- Define security quality gates aligned with the Definition of Done (secure defaults, logging, error handling, validation).
- Establish secure coding guidelines and lightweight training for engineers.
Vulnerability Management
- Own the vulnerability lifecycle: identification → triage → prioritization → remediation tracking → verification.
- Coordinate penetration test preparation and remediation with engineering teams (when applicable).
- Maintain visibility into security risk across products (risk register / issue tracking with clear owners).
Cloud & Infrastructure Security (in partnership with DevOps)
- Partner with DevOps on IAM least privilege, secrets management, network boundaries, and secure deployment practices.
- Ensure security standards are implemented as automation and guardrails rather than manual processes.
Incident Readiness
- Define basic incident response playbooks and escalation paths.
- Support incident investigations with evidence collection, root cause analysis, and prevention plans.
Required Technical Skills
- Strong practical experience in application/product security and secure SDLC.
- Ability to threat model and translate risks into concrete engineering tasks.
- Solid knowledge of common web security risks (OWASP-style classes) and mitigations.
- Experience with vulnerability management workflows and prioritization (risk-based).
- Familiarity with CI/CD security tooling (SAST/DAST/dependency scanning/secret scanning).
- Good understanding of cloud security fundamentals (IAM, secrets, network boundaries).
- Strong communication skills: can work with engineers without creating bottlenecks.
Nice to Have
- Experience with multi-tenant SaaS security patterns (tenant isolation, entitlements, audit logging).
- Experience with GCP security services and common Kubernetes security practices.
- Experience supporting compliance initiatives (SOC 2 / GDPR / ISO 27001) from the security implementation side.
- Experience with WAF, rate limiting, bot protection, and DDoS mitigations (often with DevOps).
Behavioral Expectations
- Enablement-first: makes teams safer without slowing delivery unnecessarily.
- Pragmatic rigor: focuses on highest-risk surfaces and prevents repeat issues.
- Automation mindset: prefers guardrails and checks over policy-only approaches.
- Clear communicator: writes actionable recommendations and closes loops to completion.
- Ownership: tracks risks through remediation and verifies outcomes.