Security Engineer- Application & Cloud at Zello
- Full-time.
- Hybrid.
- In Austin, TX.
IMPORTANT: Please be aware, scammers may try to impersonate Zello by reaching out regarding job opportunities. We will never ask you for bank account information, checks, or other sensitive information as part of our hiring process. All correspondence will come from the [website removed] email domain. If you’re unsure, please email [email removed] with questions. ABOUT ZELLO Zello is a voice-first communication platform, powered by our industry-leading push-to-talk technology, to improve collaboration and productivity for desk-less workers. With over 175+ million users, we’re the #1 rated push-to-talk app in the world, delivering 9 billion (yes, with a B) messages a month. At Zello, our company values are at the heart of what we do everyday. We’re proud to serve the frontline, we’re privileged to connect people in times of crisis across the globe, and we’re honored to support first responders. And this is where you come in. Zello keeps frontline teams connected with instant voice, on a platform trusted by public safety, healthcare, utilities, and large retail. Our Security Engineering function has proven that AI can multiply security signal: our AI security reviewer is now our largest source of findings. The bottleneck has moved from detection to triage and remediation. You'll be the second security engineer, splitting an operate/build rotation with the Director of Security Engineering and building the automation that lets security scale without scaling headcount. AFTER A SUCCESSFUL FIRST YEAR, YOU WILL - Have completed Zello's Google Cloud hardening project, including the long-standing items that had been open for more than six months. - Have set the direction for and shipped supply chain security: SCA, SAST, and secrets scanning running in CI across our primary repos and blocking on High/Critical findings, plus package inventory and malicious-package scanning. - Have launched a vulnerability triage pipeline within six months that deduplicates, scores, and routes findings to owning teams, and auto-triages at least half of incoming findings by month twelve. - Have helped turn the vulnerability backlog net-negative and brought High/Critical findings open past SLA to zero, with the AI security agent tuned so its findings arrive already triaged. WHAT YOU'LL DO - Take your turn on interrupt duty (findings triage, access questions, incidents, and customer security assessments), then swap to protected build time. - Tune the AI security reviewer and triage agents, and decide which calls stay with a human owner. - Build the intake pipeline that routes findings from the AI reviewer, bug bounty, pen tests, and audits to the teams that own the code, with SLA clocks per severity. - Lead the Google Cloud hardening project across IAM, org policy, and workload configuration. - Choose and roll out code scanning and supply chain controls in GitHub and CI/CD, and make sure engineers can act on what the scanners find. - Review code and designs that touch authorization, identity, and tenancy, and push fixes through Platform, Web, and Backend teams. - Write the runbooks and requirements that let anyone on the team run a security process without you. WHO YOU ARE - You've built and shipped security automation in code, and you can walk us through something you wrote that still runs in production. - You've applied LLMs or agents to real security work, and you have opinions about where AI output needs a human owner. - You can read application code and spot an exploitable authorization, identity, or secrets flaw, then explain it to the team that has to fix it. - You've rolled out security scanning in CI and turned the results into fixes, not just dashboards. - You've secured IAM and workloads in a major cloud. GCP is ideal; AWS or Azure is fine. - You get fixes shipped by teams you don't manage, and engineers describe working with you as straightforward. - You learn fast and go broad. …