Summary
What you’ll impact
Our company is seeking a Security Engineer to own and mature security across its cloud infrastructure, voice pipeline, and internal systems. The role involves hands‑on risk reduction, compliance support, and close partnership with engineering to embed security into the product.
Responsibilities
What you'll do
- Own security architecture and hardening across our cloud infrastructure, voice pipeline, and internal systems.
- Design and implement security controls for identity and access management, network segmentation, encryption, and secrets management.
- Partner with engineering on secure design reviews, threat modeling, and code-level security guidance for new features.
- Provide technical guidance on application, API, cloud, platform, and AI security.
- Support Guava's compliance program (SOC 2, HITRUST i1, HIPAA, and customer security questionnaires), including evidence collection and control implementation.
- Build and maintain security monitoring, logging, and alerting across production systems; lead incident response when issues arise.
- Manage relationships with external security vendors, auditors, and penetration testers, and drive remediation of findings.
- Own security-related tooling and automation (SAST/DAST, dependency scanning, CSPM, SIEM) as the team and platform scale.
- Contribute to security policy, employee security training, and vendor risk assessments in partnership with People Ops and compliance.
Requirements
What you’ll bring
- 4+ years of experience in security engineering, application security, or a related infrastructure/security role.
- Hands-on experience securing cloud infrastructure (AWS, GCP, or Azure) — IAM, networking, encryption, and secrets management.
- Experience supporting a compliance framework such as SOC 2, HITRUST, HIPAA, ISO 27001, or PCI DSS.
- Comfortable reading and reviewing code for security issues, and working directly with engineers to fix them.
- Practical experience with vulnerability management, security monitoring/SIEM tooling, and incident response.
- Strong written communication — you can explain risk and tradeoffs clearly to both engineers and auditors.
- Based in or willing to work from Guava's Downtown Los Angeles (Arts District) office.