Senior Security Engineer

Our Engineering Standards at Karbon:

Balance Speed and Quality

Engineers are expected to balance delivery speed with a strong commitment to quality, meeting agreed timelines while producing reliable, maintainable, and well-tested solutions. Sound judgment in making trade-offs between velocity and long-term sustainability is essential.

Collaborate Effectively

Engineering is collaborative by default. Team members are expected to contribute constructively in design discussions, reviews, and planning, communicate clearly about progress and risks, and support shared team outcomes in both hybrid and distributed environments.

Build and Maintain Systems

Engineers are responsible for building new capabilities while maintaining and improving existing systems. This includes designing scalable solutions, reducing technical debt, supporting operational stability, and contributing to continuous improvement.

Operate with Autonomy

A high degree of autonomy is expected. Given clear objectives, engineers should independently translate problems into actionable technical approaches, proactively identify improvements, and continuously expand relevant technical expertise.

Ownership and Accountability

Ownership is fundamental. Engineers are accountable for the quality, performance, and customer impact of their work from design through post-release support, and are expected to follow through on commitments.

AI-Enabled Engineering

AI is reshaping how software is built, and we are committed to leveraging it as a force multiplier for creativity, impact, and capability. Engineers are expected to confidently apply strong technical fundamentals while embracing AI tools and approaches to enhance productivity, problem-solving, and innovation. Curiosity, adaptability, and enthusiasm for integrating AI into meaningful product development are essential.

Contribute to Team Culture

Engineers contribute positively to a culture of professionalism, transparency, low bureaucracy, and mutual respect, strengthening team performance through authenticity, curiosity, and collaboration.

About the Role! 

Seeking a development & cloud focused Senior Security Engineer to join our expanding security team.

The ideal candidate will have passion for AppSec, Cloud and AI. They will be a skilled communicator and relationship builder capable of promoting and building security practices across the organization and into our development processes.

AI is reshaping practices across the board and at Karbon we’re fully committed. We don’t see AI as a replacement but as a force multiplier. We’re looking for Security Engineers who are confident in network & security fundamentals, driven to grow, and excited by the challenges and opportunities AI brings.

What You’ll Own:

• Partner with different areas within Karbon - You will make sure security is embedded from the start from feature design and development to participating in design reviews and threat modelling.
• Balance Security and Delivery - You know how to balance delivery needs with security and can communicate security risks and issues to non technical stakeholders. You understand when it's important to push back, when to compromise and how to work with delivery teams to reach a great outcome.
• You keep up to date on the latest technologies and approaches - You are excited by the new developments such as AI bring to security but also understand the importance of security foundational practices such as good account hygiene, least privilege, attack surface reduction and MFA.
• Identify and assess security risks introduced by AI tools - You’ll assist with reviewing the risks of AI tooling usage & Integration and AI-generated code.
• Apply AI-assisted tooling to accelerate security work - you understand the impact AI can have and utilize it across many areas including triage, threat detection, code review, and documentation.
• Flexibility and confidence to work across multiple security domains - We’re a small team responsible for Security at a fast moving company and you’ll get exposure to many different security domains; you could be assisting with refining and investigating corporate IT security processes in the morning, reviewing a cloud hosted system after lunch and then tweaking detection rules!
• Work effectively as part of a team - Security is a team sport and you understand the need to build relationships and trust across the organization to enhance Karbon’s security posture. You are happy to answer questions and offer advice to teams that will reach out for your assistance.
• Own your work - You take pride in your work, feeling a deep sense of responsibility for the products we develop and ensuring we keep our customers' valuable data secure. This sense of ownership is paramount, and you share this commitment.
• Bring your passion and personality - Your creativity, curiosity, and authentic self make the team stronger. If you've worked in highly political environments, you'll find our culture, free from office politics and valuing openness and authenticity, a refreshing change.
• Help us measure improvement and steer our roadmap - Contribute to Security Metrics so we can track progress and feedback into our roadmap.

What Sets You Apart

4+ years experience in a security or development role across most of the following:

• Collaborating with teams to review designs & implementations for security issues and embedding good security practices across software development
• Triaging issues and reports, assisting teams to remedy items and testing fixes
• Working with external penetration test companies to validate and prioritize findings
• Conducting risk and vulnerability assessments of web applications and APIs and third party suppliers and integrations
• Configuring and tuning SAST, SCA and DAST Tooling
• Working with build/deployment pipelines to incorporate security tooling (Github Actions or Azure Devops YAML based pipelines)
• Assisting with implementing security focused alerting and detections and automations
• Conducting and facilitating organizational & developer focused security training
• Assisting with operational security items such as EDR alerts and MDM
• Contributing to our security roadmap

In addition you’ll need:

• Strong communication skills (spoken and written) 
• Some of the following Languages/Frameworks: Microsoft .NET/C#, JavaScript (we use React and EmberJS frameworks and, Python)
• At least one cloud platform: Azure, AWS or GCP (we use Azure predominantly)
• Working knowledge of PowerShell or Bash and Python
• Working knowledge of at least one AI development tool e.g. Claude Code, GitHub Co-Pilot etc
• Portswigger Burp or similar
• Certifications such as Offsec OSCP & AWAE, GIAC, Burp Practitioner, PJPT, Microsoft/AWS development and cloud related are nice to have
• Experience with securing AI applications, systems and AI tooling would be highly regarded

Why Work at Karbon?

• Gain global experience across Australia, New Zealand, UK, and Canada
• Strong benefits package including:
• Flexible Time Off with an encouraged 4 weeks use per year
• Company paid medical for you and eligible spouse/partner and dependents
• Paid dental and vision and eligible spouse/partner and dependents
• 401(k) with company matching
• Flexible Spending Account
• Up to 8 weeks paid parental leave
• Work-from-home stipend
• Work with (and learn from) an experienced, high-performing team
• A collaborative, team-oriented culture that embraces diversity, invests in development and provides consistent feedback
• Be part of a fast-growing company that firmly believes in promoting high performers from within

Your Role as a Cloud Security/Penetration Test Engineer :

We are seeking a highly skilled Cloud Security Engineer to join our dynamic team. This is a crucial customer-facing role where you will be instrumental in designing, implementing secure cloud configurations, manual web application testing and securing complex cloud environments for our clients across Google Cloud Platform (GCP), Microsoft Azure, and Amazon Web Services (AWS), with a strong emphasis on GCP. A fundamental part of your role will be demonstrating your ability to manually penetration test web applications. 

You will leverage your deep expertise in SaaS security, network security, and compliance to provide strategic guidance and hands-on support, ensuring our clients' cloud infrastructures are robust, resilient, and compliant with industry standards.

What You'll Do:

• Perform manual penetration testing activities on Web Applications and Mobile Applications using black-box testing tools, in-depth penetration test (using shell scripts and manual testing) techniques, DAST & SAST tools. The candidate should be highly experienced with black box, gray box and white box testing techniques along with red teaming skills 
• Understand the application architectural components, business purpose of the application and code at high level. The resource will be responsible for assisting in architecting secure coding practices.
• Web Application: Highly familiar with OWASP Top 10 and the ASVS. You will be the Subject Matter Expert within the organization to demonstrate OWASP Top 10 findings and provide resolution recommendations. 
• Cloud Security Operations: Design, implement, and optimize robust cloud security architectures to enhance, build, monitor and address all security alerts from our SIEM and other security systems. This is an operational role whereby you will be available M-F 8am-5pm EDT and on-call shifts on evenings and weekends.  
• Network Security Expertise: Your network security and cloud security expertise will be required to respond to customer questionnaires, customer calls and create artifacts including network diagrams, architecture diagram, data flow diagrams and other artifacts to support customer requests. Strong written skills will be required here and attention to detail. 
• Firewall & WAF Management: Configure, manage, and troubleshoot cloud-native firewalls (e.g., GCP Cloud Firewall, Azure Firewall, AWS Security Groups/NACLs) and Web Application Firewalls (WAFs) to protect web applications from common vulnerabilities and attacks. The candidate will demonstrate past hands-on network experience in managing complex layer-4 to layer-7 rules. 
• SIEM Integration & Optimization: As a Level-2 Security Operations support team member, you will review all security alerts and resolve these alerts in a timely manner. You will work with our current Security Operations team to expand on our current alerting and reporting capabilities to enhance visibility across our attack surface. Powershell or similar scripting skills will be required. 
• SaaS Security Best Practices: Provide expert guidance on securing SaaS applications, including identity and access management (IAM), data encryption, API security, and secure configuration baselines. You will be responsible for leading and managing all firewall reviews, access reviews, system reviews and risk assessments. 
• Compliance & Governance: Lead and contribute to compliance initiatives, ensuring cloud environments adhere to industry regulations and frameworks such as GDPR, SOC 2, ISO 27001, CMMC and CSA STAR. Conduct security assessments and gap analyses.
• Customer Engagement & Presentation: Act as a trusted advisor to clients, effectively communicating complex technical security concepts to both technical and non-technical stakeholders. Deliver engaging presentations, attend client workshops, and build strong client relationships.
• Incident Response & Remediation: Support incident response activities by providing expert analysis and remediation strategies for cloud security incidents. This will extend to leading Incident Response Plan initiatives and creating documentation for all parties to follow specific plans. 
• Vulnerability Management and Penetration Testing: Responsible for running the comprehensive vulnerability management and penetration testing program. The candidate will be responsible for reviewing, interpreting and advising operations teams on how best to remediate identified vulnerabilities and work with the operations to bring all findings to a close. The candidate will be responsible for working with our software development teams to review, manage and collaborate on the remediation of open OWASP findings. 
• Stay Ahead of the Curve: Continuously research and evaluate emerging cloud security threats, technologies, and best practices.

What You Bring:

• 10+ years of progressive experience in web application penetration testing, cybersecurity, with at least 4+ years focused on cloud security engineering.
• Strong organizational, administrative, project management and communication skills will be required to manage the overall security program.
• Deep hands-on experience with Google Cloud Platform (GCP) security services and best practices is essential and managing cloud security alerts in our SIEM.
• Strong practical experience with Microsoft Azure and Amazon Web Services (AWS) security services.
• Proven expertise in securing SaaS applications and understanding of common SaaS security challenges.
• Extensive experience with scripting skills, network security principles and implementation in cloud environments.
• Demonstrable experience with firewall management (cloud-native and third-party) and Web Application Firewalls (WAFs).
• Hands-on experience with SIEM platforms (e.g., Splunk, Microsoft Sentinel, Google Chronicle Security Operations, Datadog, etc) including sink creations, log ingestion, rule creation, and dashboarding.
• Strong understanding of cloud identity and access management (IAM) principles and best practices across multi-cloud.
• Solid knowledge of compliance frameworks and regulations (e.g., GDPR, SOC 2, ISO 27001, CMMC).
• Excellent communication, presentation, and interpersonal skills, with the ability to articulate complex security concepts clearly and concisely to diverse audiences.
• Ability to work independently and as part of a team in a fast-paced, client-facing environment.
• Problem-solving mindset with a strong attention to detail.
• CISSP is required. Azure and Google certifications are highly desirable. 

Required Qualifications:

• Bachelor's Degree in Statistics, Computer Science, Risk Management, Cyber Security, or related field 
• 5+ years of experience in web application penetration testing 
• 5+ years in cloud or network penetration testing 
• 4+ years of experience managing, tracking and supporting a security program including compliance, risk management, security operations, security engineering and cloud security initiatives.
• 4+ years of experience securing, configuring and supporting cloud environments (Azure and GCP)
• 4+ years of experience supporting a security operations center, managing security alerts, configuring SIEMs and, creating custom alerts using PowerShell, Python or Bash scripts
• Provide guidance on security vulnerabilities, responding to security questionnaires,  working with software engineering teams on OWASP Top 10 vulnerabilities, secure coding practices, and threat modeling.
• Microsoft certifications a plus
• Security Certifications: CISSP, GWAPT, OSWA or OSCP are required, CISM desirable and other certifications would be a plus.

Bonus Points If You Have:

• Relevant industry certifications like OSWE or Cloud Provider Certifications (e.g., Google Cloud Professional Cloud Security Engineer, Azure Security Engineer Associate, AWS Certified Security – Specialty, CCSP).
• Experience with Infrastructure as Code (IaC) tools (e.g., Terraform, CloudFormation, ARM templates) for security automation.
• Scripting skills (e.g., Python, PowerShell, Bash).
• Experience with container security (Docker, Kubernetes).
• Knowledge of DevSecOps principles and practices.

The Perks of Working for Appspace:

For all our US based team members, we offer a variety of benefits from competitive salaries, medical, dental and vision coverage, disability coverage, employer paid life insurance, mental health resources, 401(k) plan and a fully paid parental leave program.

Additional perks include:

• Generous PTO
• Flexible work schedules
• Remote work opportunities
• Paid company holidays
• Appspace Quiet Fridays (No non-essential internal meetings scheduled)
• A casual dress work environment 

The total target compensation for this role is $240,000 - $280,000. #LI-KS1

Job Description: 

The Regional Business Manager (RBM) will shape the Territory Account Manager (TAM) organization by creating a culture of performance and accountability based in transforming the standard of care in diagnosing CAD.

The RBM will hire, train, coach and develop their respective territory account manager team to execute against specific critical behaviors that deliver growth results. The Territory Account Manager (TAM) will be the face of Heartflow within a specific geographic region. The RBM will work with customers to ensure that they are extremely successful with Heartflow’s non-invasive cardiovascular diagnostic technology. It is the responsibility of the RBM to provide the team with expectations, resources and coaching to the standard that drives Heartflow adoption through the network of referring physicians. The position will partner with TAMs and accounts to proactively support, educate, and provide solutions to build high customer satisfaction.

This is a customer- facing role.  The primary focus is on spending time with direct sales team and customers. Customers include yet are not limited to Cardiologists, Internists, general practitioners, Nurse practitioners and physician assistance that manage patients with ACS/CAD.

Job Responsibilities:

• Will work cross functionally to create solutions as new opportunities present.
• Create progressive programming that disrupts the traditional means to reach ordering physicians who treat and manage patients with CAD.
• Will work directly with key strategic Heartflow accounts to drive growth and adoption of a cCTA and FFRct clinical pathway. In these accounts, the RBM will develop and execute business development plans working closely with the account’s key stakeholders.
• Facilitate cross-functional collaboration throughout the organization. Tools for program development could include key deployment of Heartflow’s internal leadership and physician mentors, organizing and staffing of dinner programs, VIP Visits, organizing Heartflow CT Pathway road-shows, referring physician office meetings, etc. This role will work closely with the other Heartflow team members to include respective TSM, Marketing, Market Access, CT Apps, Product Development and Clinical.
• Increase Heartflow usage within the designated key strategic Heartflow account by:
  • Maintaining and building relationships with referring physicians and other key clinical stakeholders
  • Educating customers on Heartflow’s value proposition by giving presentations/ having discussions with referring MDs
  • Promoting / championing Heartflow and building advocacy
• Production/Success/Achievement of the Territory Account Manager will be evaluated and based on performance in active/targeted accounts (metrics):
  • Meet / exceed quota for the strategic Heartflow accounts (within existing customer locations).
  • cCTA growth (conversion of non-invasive tests) and FFRct penetration / case growth over baseline (% and $) in assigned accounts.

Skills Needed:

• Meeting Sales Goals, Motivation for Sales team, Territory Management, Presentation Skills, Performance Management, Building Relationships, Emphasizing Excellence, Negotiation, Results Driven, Sales Planning, Managing Profitability
• Demonstrate ability to hire, develop, performance manage and promote talent
• Proven sales management skills and track-record of sales achievement
• Account development - Experience building and supporting strong clinical programs
• Clinical / technical proficiency - Quick learner able to grasp new clinical/technical information and then disseminate to customers.
• Develop relationships with key account stakeholders, drive awareness of a cCTA/FFRct pathway, broaden Heartflow referrals, and deepen Heartflow adoption.
• Work in a cross functional capacity to coordinate field and HQ resources needed to support focused customers and execute program development plans, support sales, marketing, education and training.
• Customer-focused mentality.
• Knowledge of cardiac patient pathways and diagnostic technology is preferred.
• Self-motivated and ability to initiate, organize, and complete projects.
• Excellent problem-solving ability, especially under pressure.
• Extremely strong work ethic.
• Works well in a cross-functional team environment.
• Excellent verbal and written communication skills. Professional etiquette.
• Experience with Salesforce.com or similar CRM

Educational Requirements & Work Experience: 

• 4-year degree with 5+ years of related sales or clinical experience or 2-year degree with 7+ years related sales or clinical experience.
• Degree in Science, Medical, Business, Marketing or Technical field is preferred.
• Prior experience in medical device, cardiology pharmaceuticals, cardiology radio-pharmaceuticals, hospital, or medical software is highly desired
• Experience with introducing new cardiovascular technologies into hospitals is highly desired

Physical Demands of the Job: Up to 60% travel from your home office is expected.