Security Engineer II

About the Role

As a Security Engineer II, you will report to the Sr. Engineering Manager, Site Reliability Engineering and join a team of Site Reliability Engineers (SRE) and Data Engineers. You treat security concerns as first-class citizens and will prioritize industry best practices. You will work closely with Software Engineers and product team members to help them embed security tools and practices across all teams and phases of the software development lifecycle. You will collaborate closely with SREs, software architecture, IT and other roles to measure and report on cloud systems security compliance. You recognize the importance of stability, scalability, and uptime, with a critical focus on the security of our software systems and infrastructure. You enjoy helping colleagues identify important security vulnerabilities and supporting them to contribute meaningful improvements to the Subsplash products and platform.

Your Priorities

• Drive for and enable proactive identification, analysis, and remediation of security vulnerabilities in our software codebases and cloud infrastructure systems


• Respond to manage our pen testing and bug bounty programs


• Focus on selecting, integrating, and operating apps and tools that multiply individual efforts by automating preventative strategies, to help drive down manual, reactive tasks


• Work in partnership with Software Architecture, Risk/Compliance, the SRE team, and other partners, to integrate security capabilities into the software development lifecycle (SDLC).


• Participate in security reviews, threat modeling, and security improvement workshops


• Promote awareness of, and adherence to, secure coding best practices and standards


• Influence the strategy and implementation of security solutions, advocating for DevSecOps principles and identifying effective and efficient security guardrails


• Prioritize secure, scalable, observable code and infrastructure with a bias towards continuous improvement


• Design, develop, integrate, and maintain our core security tooling (e.g. SAST/DAST, SCA, etc.), driving adoption and iteration to provide clear value to engineering teams


• Maintain great communication with engineers and colleagues to help bridge the gap between compliance requirements and security solution implementation and iteration


• Participate in the team’s on-call rotation as needed, acting as the primary security subject matter expert for high-severity or escalated security incidents


• Partner with the IT team to provide security consultation and technical expertise with ad hoc projects and requests


• Act as the primary technical subject matter expert for the cybersecurity remediation project, working in lockstep with the SRE Manager and SRE team to implement solutions and track progress toward successful, timely completion.

Required Education + Experience

At least 3 to 5 years of full-time experience in a security engineering or similar role in a group/team environment

Familiarity with common web application and network security concepts, threats, and vulnerabilities (e.g., OWASP Top 10)

Experience with security best practices across different technology stacks (e.g., server-side, client-side, mobile)

Proven ability to design and implement secure architectures in a cloud-native environment, including experience conducting threat modeling and security design reviews

Embracing the Agile and feature-driven development processes

Desired Skills + Experience

Bachelor of Science in Computer Science, Computer Engineering, Cybersecurity, or equivalent experience

Experience with security features and tools available from cloud providers such as AWS, Azure, and GCP

Experience with security testing tools (e.g., SAST, DAST, penetration testing tools)

Experience with configuration management and infrastructure as code tools (e.g., Terraform, Ansible)

Knowledge of data security best practices

About Subsplash

Subsplash is an exciting, award-winning team of 290+ mission-driven people who are committed to our core values of humility, innovation, and excellence. Founded in 2005, we’ve remained family owned and operated while pioneering the market with the first ever church mobile app. Since then, we’ve been working together to build The Ultimate Engagement Platform™ for churches, Christian ministries, non-profits, and businesses around the world. We find excitement in serving our 17,000+ clients, creating impactful products, and delighting the 40 million real people who use our platform every day. Subsplash has won awards for best mobile experience, been voted top 100 Washington's Best Workplaces by the Puget Sound Business Journal, created some of the most downloaded apps of all time, and built enterprise software for world-class brands like XBOX, Microsoft, Samsung, Expedia, and Cisco; yet, at the end of the day, we love making a lasting impact and a difference in our world. Working at Subsplash is more than just a job; we are a team of people who are courageous, inventive, and passionate about doing meaningful work every day. Don’t take our word for it—head to Glassdoor and see for yourself!

About the Team

The Subsplash Product & Engineering Team is responsible for all products that the company develops including the App Platform and Merchant Services. We are a team of designers, developers, and coordinators, creating polished experiences for our clients and end users. The P&E Team is responsible for the entire user experience including: End-User Mobile Apps, the Subsplash Dashboard (our Content Management System), Subsplash Giving (Our Donation and Merchant Services Platform), Media services, the Web App, backend data feeds, analytics, and more. The Product Team supports our Clients by providing a unified set of tools to help reduce administrative overhead so Clients can focus on their core mission and expand their reach.