What You ll Do Security Leadership & Strategy Own the overall security roadmap and strategy for PetroApp, aligning it with business and product priorities. Act as the primary security point of contact for engineering and leadership. Define, document, and maintain security policies, standards, and guidelines for engineering teams. Lead risk assessments, threat modeling, and security design reviews for major initiatives. Define and track key security KPIs and report status, risks, and progress to leadership. DevSecOps & SDLC Security Embed security into the SDLC by integrating SAST, DAST, dependency and container scanning, and IaC scanning into CI/CD pipelines. Establish secure coding practices and patterns; provide guidance and reviews for high-risk changes. Set up and maintain secrets management and secrets detection across repos and environments. Drive vulnerability management: triage findings, prioritize remediation, track SLAs, and verify fixes. Partner with engineers to ensure security controls are automated and developer-friendly. Cloud & Platform Security (with SRE Mindset) Own and continuously improve the cloud and platform security posture (IAM, networking, encryption, key management, hardening). Design and enforce least privilege access models and secure-by-default infrastructure baselines. Ensure security is built into core platform components such as Kubernetes, service-to-service communication, and data stores. Collaborate with SRE/DevOps on secure, resilient architectures, covering scalability, failover, and disaster recovery. Reliability & Incident Collaboration Collaborate with SRE/DevOps to maintain high availability and reliability of production systems. Contribute to observability and monitoring with a security lens: actionable alerts, meaningful logging, and traceability. Participate in incident response for security-related events, including root cause analysis and long-term fixes. Help improve on-call and incident processes where security and reliability intersect. External Security Engagements & Enablement Own relationships with external security vendors, including penetration testing and security assessments. Scope, coordinate, and manage penetration tests; track findings through to remediation and retesting. Coordinate security-related input for audits, certifications, and customer security questionnaires as needed. Run security awareness and training initiatives tailored to engineers and operational teams.