Security Lead (DevOps/SRE)

PetroApp

What You ll Do Security Leadership & Strategy

• Own the overall security roadmap and strategy for PetroApp, aligning it with business and product priorities.
• Act as the primary security point of contact for engineering and leadership.
• Define, document, and maintain security policies, standards, and guidelines for engineering teams.
• Lead risk assessments, threat modeling, and security design reviews for major initiatives.
• Define and track key security KPIs and report status, risks, and progress to leadership.

DevSecOps & SDLC Security

• Embed security into the SDLC by integrating SAST, DAST, dependency and container scanning, and IaC scanning into CI/CD pipelines.
• Establish secure coding practices and patterns; provide guidance and reviews for high-risk changes.
• Set up and maintain secrets management and secrets detection across repos and environments.
• Drive vulnerability management: triage findings, prioritize remediation, track SLAs, and verify fixes.
• Partner with engineers to ensure security controls are automated and developer-friendly.

Cloud & Platform Security (with SRE Mindset)

• Own and continuously improve the cloud and platform security posture (IAM, networking, encryption, key management, hardening).
• Design and enforce least privilege access models and secure-by-default infrastructure baselines.
• Ensure security is built into core platform components such as Kubernetes, service-to-service communication, and data stores.
• Collaborate with SRE/DevOps on secure, resilient architectures, covering scalability, failover, and disaster recovery.

Reliability & Incident Collaboration

• Collaborate with SRE/DevOps to maintain high availability and reliability of production systems.
• Contribute to observability and monitoring with a security lens: actionable alerts, meaningful logging, and traceability.
• Participate in incident response for security-related events, including root cause analysis and long-term fixes.
• Help improve on-call and incident processes where security and reliability intersect.

External Security Engagements & Enablement

• Own relationships with external security vendors, including penetration testing and security assessments.
• Scope, coordinate, and manage penetration tests; track findings through to remediation and retesting.
• Coordinate security-related input for audits, certifications, and customer security questionnaires as needed.
• Run security awareness and training initiatives tailored to engineers and operational teams.