Job Description

We’re looking for a full-stack engineer to join our security organization. We are a quickly growing team working on hardening all aspects of Reverb’s security posture. This role has room for creative analysis as well as implementation work! As a Security Engineer, you will have the chance to share your expertise on what we need to do to maintain and improve Reverb’s security baseline, and promote those practices to the broader organization.

This is a full-time position reporting to the Engineering Manager of our Security team. We are open to remote hires within multiple states as well as candidates locally in Chicago, IL. For candidates who will work remotely visit this link for a list of approved locations.

Core technologies we work with and secure:

• Application layer: Ruby on Rails, React, Go
• Data layer: Postgres, ElasticSearch, Redshift, Redis
• Infrastructure: AWS IAM, VPC, Fastly, Terraform
• Logging and Monitoring: Datadog, CloudTrail, Sentry

Projects you might work on in your first 12 months:

• Hardening our application based on findings from internal testing, pen tests and our bug bounty program
• Adding tools to our edge protection layer to help combat abusive traffic
• Implementing risk-based security notifications
• Integrating automated security testing into our CI/CD pipeline

Responsibilities:

• Deliver well-tested, peer-reviewed features that improve the security experience of Reverb’s users and prevent abuse
• Collaborate with other engineering teams to across the stack to deliver projects
• Find opportunities to harden Reverb’s application, infrastructure and organizational security posture
• Monitor and respond to security incidents
• Make well-reasoned, technical decisions backed by data while understanding tradeoffs

Qualifications

• 5+ years of experience contributing to the implementation and support of highly maintainable and scalable systems by contributing to all levels of the web applications stack
• 3+ years of experience working in Ruby, Python or Node
• Experience with CI/CD and comfort with developing in a codebase that is deployed to production multiple times a day
• Understanding of basic software security patterns in development

Nice to Have

• Knowledge of the UNIX command line and common tools
• Experience with hardening applications to protect against the OWASP top 10 
• Comfort with Docker in development and production
• Experience with Terraform