Sr. Security Engineer (ISO 27001 and AppSec experience required)

Headquarters: Remote, North America URL: http://www.aha.io

Aha! is the world's #1 roadmap software. We help more than 5,000 companies build lovable products and be happy doing it. Our company is self-funded and profitable, and has been entirely remote since we started in 2013.

Our team

Aha! engineering is a mid-sized, fully remote team that is highly productive. We are centered around North American time zones so we can collaborate during the workday.

• We move quickly: We ship code multiple times a day. We believe in getting new features in front of customers and iteratively improving as we learn what works and what does not.
• We collaborate: We each bring unique experiences and skills to the table. Working together to share that knowledge benefits the entire team and helps us produce the best results for our customers.
• We value product over process: We want the team to have the time and focus to solve complex challenges. We aim to minimize the overhead introduced by heavyweight processes and excessive meetings.
• We are happy: it is important to us that you love your job and are happy at work. Learn more about our company values. Check out our generous benefits.
• We enjoy: We like what we do. And we want you to love your job too. Learn more about The Responsive Method, our company values, and the generous benefitswe offer.

Our security program

Our sole product is the Aha! web application. It is a single-instance, multi-tenant Ruby on Rails application that we run in a dedicated Amazon Web Services environment with multiple layers of security controls.

Our information security management system (ISMS) is ISO 27001 certified to demonstrate our commitment to security to our customers. We undergo annual third-party ISO 27001 audits and third-party application penetration testing with excellent results. We continually improve our security controls to meet and exceed our customer security expectations.

We embrace new technologies that help us deliver a lovable product, but we also remain cognizant of the maintenance overhead that a new technology or platform brings. We solve the problems in front of us rather than prematurely optimizing to address issues that may never materialize.

We do most of our collaboration and planning in Aha! itself, which we find especially rewarding. We also utilize GitHub, Slack, and GoToMeeting for video calls.

Your experience

We believe that being a kind person who elevates the rest of the team is just as valuable as writing great code. You have strong problem-solving skills and experience working on important functionality for a cloud-based product. You are humble, eager to learn, and always willing to help others learn as well. You want to work with people who enjoy picking up a problem and solving it, regardless of the technologies and techniques involved.

The Aha! security team is part of the engineering team and is product focused. As a Senior Security Engineer focused on our security program, you can expect to spend the majority of your time working with security controls, policies, risk reduction, and customer security questions.

Your work at Aha!

We implement and maintain security controls across the entire company with a deep focus on our product. Your work will include:

• Operating and improving our security controls implemented as part of our ISO 27001 certification
• Performing and reviewing system and vulnerability scans with a focus on application security
• Collaborating with business stakeholders to perform risk assessments and treatments
• Driving security and privacy initiatives, training, and features to reduce risk
• Updating, maintaining, and creating security and privacy policies
• Responding to customer security questions and requirements
• Preparing for and representing Aha! in external ISO 27001 audits
• Participating in security monitoring, incident response, and investigations

If this sounds appealing, we would love to hear from you. (A real human reviews every application.)

To apply: