Security Engineer

As a Security Engineer reporting to the CISO, you’ll be a key member of our security branch, focusing on our product and platform security. This role combines hands-on security engineering with technical guidance, requiring to implement security controls and guide other engineers in secure development practices.

This is a role for someone who enjoys turning security requirements into practical, automated and maintainable solutions: you design the control, you implement it, you help teams adopt it, and you keep improving it.

Your missions:

Build and strengthen our security foundations

• Enhance and expand security controls across our Kubernetes infrastructure.
• Develop security automation tools and frameworks, and put them into practice.
• Strengthen the security of our CI/CD pipelines.
• Help drive our patch management strategy and handle patch implementation.

Secure our applications and software supply chain

• Perform security code reviews across our codebases.
• Implement software supply chain security controls and verification systems.
• Audit, evolve and implement secure coding standards and practices.
• Build upon our existing security testing frameworks and procedures.

Contribute to our security strategy

• Work closely with the CISO, Engineering and Infrastructure teams to implement security strategies across our product and architecture.
• Support security audit and compliance initiatives by helping retrieve the required evidence.
• Help evaluate and implement new security tools and technologies.

Grow our security culture

• Develop and deliver security training materials.
• Collaborate with engineering teams to embed security practices into their day-to-day work.
• Create security documentation and guidelines.
• Automate everything.

The position can be based in Paris or Rennes (up to 3 remote days per week). Professional trips paid for by the company might be required.

• You have 3+ years of security engineering experience, or equivalent experience.
• You have strong expertise in application security and secure software development.
• You have experience implementing SAST and DAST.
• You have strong expertise in Python, with familiarity in TypeScript/Angular or similar technologies.
• You have extensive experience with the following technical stack:
• Kubernetes
• Web application security
• API security, including REST or GraphQL
• Infrastructure as Code
• CI/CD pipeline security
• Container security, including Docker and OCI
• Database security
• You have experience building security tools and automation.
• You understand software supply chain security.
• You have knowledge of modern development practices and tools.
• You are a pragmatic builder: you deliver practical security solutions with the teams’ context in mind.
• You are a knowledge champion: you share your security expertise openly and positively, and build bridges with engineering teams.
• You strive for technical mastery, leveraging deep security expertise and engineering craftsmanship.
• You are fluent in English, French fluency is a real plus!

Bonus points, if you have experience with:

• Secure runtime environments, such as gVisor
• GCP and Azure environments
• Software Composition Analysis
• Securing package management systems

Our process usually takes about 3 weeks, depending on availability; it includes reference calls. The program: discussions rather than trick questions ! These discussions will help you understand how Sekoia works and what it stands for. But they are also (and above all) an opportunity for you to tell us about your career path and your expectations for your next job!

Sekoia is an equal opportunity employer for any minority, disability, gender identity or sexual orientation. We are committed to hiring and supporting diverse teams of people from all backgrounds, experiences, and perspectives.