Security Lead

About PetroApp

PetroApp is building a modern technology platform, helping customers and partners move faster with confident, reliable systems. As we scale our engineering organization, we’re investing in both world-class reliability and pragmatic, high-impact security.

The Role

We’re hiring a Security Lead with a strong DevOps/SRE background to build and lead our security practice while remaining hands-on across cloud infrastructure, CI/CD, and production reliability.

You’ll own the security strategy across the SDLC and production environment, embed security into developer workflows, lead vulnerability management and penetration testing with external vendors, and work closely with our Platform/DevOps/SRE team to ensure PetroApp’s systems are both secure and reliable.

What You’ll DoSecurity Leadership & Strategy

• Own the overall security roadmap and strategy for PetroApp, aligning it with business and product priorities.
• Act as the primary security point of contact for engineering and leadership.
• Define, document, and maintain security policies, standards, and guidelines for engineering teams.
• Lead risk assessments, threat modeling, and security design reviews for major initiatives.
• Define and track key security KPIs and report status, risks, and progress to leadership.

DevSecOps & SDLC Security

• Embed security into the SDLC by integrating SAST, DAST, dependency and container scanning, and IaC scanning into CI/CD pipelines.
• Establish secure coding practices and patterns; provide guidance and reviews for high-risk changes.
• Set up and maintain secrets management and secrets detection across repos and environments.
• Drive vulnerability management: triage findings, prioritize remediation, track SLAs, and verify fixes.
• Partner with engineers to ensure security controls are automated and developer-friendly.

Cloud & Platform Security (with SRE Mindset)

• Own and continuously improve the cloud and platform security posture (IAM, networking, encryption, key management, hardening).
• Design and enforce least privilege access models and secure-by-default infrastructure baselines.
• Ensure security is built into core platform components such as Kubernetes, service-to-service communication, and data stores.
• Collaborate with SRE/DevOps on secure, resilient architectures, covering scalability, failover, and disaster recovery.

Reliability & Incident Collaboration

• Collaborate with SRE/DevOps to maintain high availability and reliability of production systems.
• Contribute to observability and monitoring with a security lens: actionable alerts, meaningful logging, and traceability.
• Participate in incident response for security-related events, including root cause analysis and long-term fixes.
• Help improve on-call and incident processes where security and reliability intersect.

External Security Engagements & Enablement

• Own relationships with external security vendors, including penetration testing and security assessments.
• Scope, coordinate, and manage penetration tests; track findings through to remediation and retesting.
• Coordinate security-related input for audits, certifications, and customer security questionnaires as needed.
• Run security awareness and training initiatives tailored to engineers and operational teams.