SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Outset is an AI-powered user research platform used by global enterprises like HubSpot, Microsoft, Uber, and Nestle to conduct qualitative research at scale. The company recently raised a $30M Series B and is disrupting the $140B+ research industry with AI-moderated interviews.
We are seeking an experienced Platform Security Engineer to harden the security of our AWS infrastructure and codebase. This role combines application security, cloud infrastructure security, detection engineering, and incident investigation. You will partner directly with engineering and security teams to identify and remediate risks, improve architecture, and build practical security controls.
Key Responsibilities:
- Identify, assess, and remediate security risks across AWS infrastructure, Terraform code, application architecture, and product code
- Partner with engineering teams to design secure systems and integrate security into development workflows
- Conduct security reviews of RFC and PRR documentation, providing actionable feedback on architecture, data flows, access controls, and technical risk
- Review application and infrastructure changes requiring additional security scrutiny
- Participate in external penetration tests: preparation, coordination, analysis, remediation planning, and validation
- Improve the penetration-testing program with potential for ownership over time
- Serve as lead technical investigator during security and privacy incidents, working with the Head of Security
- Analyze application, cloud, identity, network, audit, and infrastructure telemetry to determine incident scope, impact, and root cause
- Translate investigation findings into containment actions, durable remediations, improved detections, and technical documentation
- Design, implement, tune, and maintain SIEM detection rules monitoring the platform
- Investigate and respond to alerts involving AWS infrastructure, application behavior, access patterns, and data movement
- Improve logging and telemetry to enable better threat detection and incident investigation
- Develop security tooling and automation to help engineers identify and address vulnerabilities earlier
- Partner with SRE and engineering teams on cloud configuration, identity and access management, secrets management, vulnerability management, and infrastructure hardening
- Establish practical security standards that reduce risk without unnecessarily slowing product development
Requirements:
- Hands-on experience in application security, cloud security, infrastructure security, or security-focused site reliability engineering
- Experience securing production systems in AWS, including familiarity with identity, networking, logging, data protection, and common cloud attack paths
- Strong working knowledge of Terraform and infrastructure-as-code security practices
- Ability to assess security across both infrastructure and application layers
- Experience reviewing application architecture or source code for security vulnerabilities and design weaknesses
- Familiarity with common application, API, authentication, authorization, and data-security risks
- Experience investigating complex technical events using application logs, cloud telemetry, audit trails, and other security data
- Experience writing, tuning, or responding to SIEM detection rules
- Ability to distinguish meaningful security signals from expected production behavior and noisy telemetry
- Experience evaluating penetration-test findings, determining practical risk, and partnering with engineers on remediation
- Strong scripting or software-development skills for building security tools, automations, and integrations
- Demonstrated proficiency with agentic software development
- Sound judgment balancing security risk, operational reliability, engineering effort, and product priorities
- Clear written and verbal communication, including ability to explain technical risks to both engineering and non-engineering stakeholders
- Collaborative approach that helps engineering teams build safer systems and make informed security decisions
Bonus qualifications: Partnership with IT Security in building security domains; technical project management experience; experience on security or privacy incident-response teams; experience leading technical investigations during incidents; SANS FOR509 training or certification; purple teaming experience; experience owning or coordinating external penetration-testing programs; experience with threat modeling, detection engineering, cloud forensics, or security automation.
