Senior Software Engineer (Security Assurance)

We are looking for a Senior Software Engineer, Security Assurance to join our GRC engineering teamWe are building a security system that’s automated at scale, rigorously data-driven, and built from the ground up with defense-in-depth and self-healing in mindWe support a highly autonomous, remote-first, cloud-native organizationWe are a technical team that can build any tool we need, while knowing when to buy to improve velocityTo support our growth and ambitious vision, we embrace agile principles and values, share openly, apply context-driven security mechanisms, default to action, and have an OSS-first mindsetWe are a 100% remote companyWe believe in high-velocity but sustainable expectations and timeframes, giving people the room to do great workYou will work to build out our security observability, compliance, and control management systems and toolsYou will develop services and tools to proactively defend our systems, provide visibility to our security state, and give engineers and stakeholders guardrails and paved roads to behave securelyYou will collaborate across your team, the security department, and wider Grafana to write and deploy security policies across all of our SDLC, applications, and infrastructureThis is a very technical, hands-on keyboard software engineering, so development experience is criticalYou will ideally have some experience building, implementing and improving the maturity of security programs in Cloud-based SaaS organizationsKnowledge of security standards and frameworks (ISO, FedRAMP, PCI-DSS, GDPR, etc) is useful, but the disposition to quickly learn new things is more important than rote knowledgeYou will work alongside other security engineers, full-stack developers, and customer-facing teamsExperience guiding and negotiating with peers, stakeholders, customers, and auditors is a plusBe a technical contributor on our GRC team covering a range of areas, including certifications, application, build, cloud, and supply chain security, and internal security tooling developmentDevelop, implement, and maintain highly automated security assurance programs to ensure compliance with organizational and regulatory requirements (e.g., ISO 27001, SOC 2, GDPR, NIST, PCI-DSS, TISAX, whatever else our customers eventually throw at us)Develop systems, automations, and methods of security observability to push the GRC engineering organization beyond just meeting certification requirementsDeploy security and compliance checks in an employee-enabling way (guardrails and paved roads) in their daily workflows and build pipelinesCollaborate with cross-functional teams to integrate security controls into the software development lifecycle and operational processesRespond to customer security issues, security alerts, and potential incidentsBenefitsVacation: Balance is key. Our team enjoys 30 days of paid vacation each year on top of national holidays, parental leave, and sick leave. We also take a breather on a number of Grafana Shutdown Days each yearHealthcare: We’re proud to provide health coverage or stipends for our colleagues in the US, UK, Canada, the Netherlands, Sweden, Singapore, and IndiaRetirement planning: There’s no time like the present to start saving for your future. We make employer contributions into the pension pots of our team members in the US, UK, Canada, the Netherlands, Sweden, and GermanyProfessional development: On top of a $1,500 annual learning and development stipend, Grafanistas have thousands of on-demand courses at their fingertips to help them grow professionally. Want to attend a conference or training? Go ahead. Just pass on what you learnedWork location: Vast majority of our roles are fully remote, focused on hiring the best talent and allowing you to perform from the comfort of your home. If you fancy a change of scene, we’ll also reimburse you up to $175 a month for a personal co-working spaceChoice of tech: There’s no one-size-fits-all when it comes to the tech required to do your job. Choose the laptop and accessories you need when you join us, and we’ll refresh them every three yearsMindfulness: When you join the team, you can sign up for a complimentary subscription to Headspace to take advantage of the benefits of mindfulness and meditation. Our wellbeing resource group also organize sessions run by fellow Grafanistas or external trainersGlobal Employee Assistance Program: We offer all team members a 100% confidential support service with 24/7 365 access to professionally qualified counsellors and specialistsPaid parental leave: Grafana offers paid parental leave to all eligible new parents. This offers Grafanistas time to bond with and care for their children in the first year after birth or adoptionUnderstanding of industry-recognized security frameworks, standards, and certifications, such as ISO 27001, SOC 2, PCI DSS, NIST, or GDPR, and how to apply them without added operational burden. You can gain this by reading the standards documents and audit guidanceExperience in automating security and compliance processes using tools, scripts, and frameworks while enabling developer and employee workflowsKnowledge of using and securing containerized, cloud-native applications, ideally with Kubernetes. Experience with multiple cloud providers is a strong plusA degree in Computer Science, Information Security, or related field (or equivalent experience)Strong interpersonal skills, as this position will require communication with peers, stakeholders, auditors, and customersExperience developing in a production environment with at least one programming language. We primarily use Go, TypeScript, and Python but most languages translate well. You will take a code screen and be expected to discuss programming principles such as algorithms, data structures, and optimizationExperience securing large-scale distributed systems running in public cloudsExperience in using technical automations to prove infrastructure complianceExperience working with OSS communitiesWorking knowledge of Grafana Labs OSS projects and products. Experience in using observability tooling to solve security problems #J-18808-Ljbffr