Security Engineer

About DISCO

DISCO is the leading platform for organizing, managing, and sharing music and media, streamlining workflows to save time. We work with major clients like UMG, Sony, Warner Music, Netflix, and Amazon, engaging hundreds of thousands of professionals each month who are passionate about our product.

Role Overview

As we expand, DISCO is enhancing its security by introducing a dedicated Security Engineer. This role builds upon our solid foundation as a SOC 2-compliant SaaS provider in the music sector. You will oversee security across the board—including application security, cloud infrastructure, detection and response, and regulatory compliance—collaborating with teams from engineering, product, legal, and leadership to fortify our systems and safeguard customer data.

Responsibilities

• Lead security engineering efforts for our Python/Django/React applications, including security design assessments, threat modeling, and code reviews for new and existing features.
• Manage static and dependency scanning, secret detection within CI pipelines, and handle the triage of associated issues.
• Organize penetration testing initiatives such as agentic scanning utilizing frontier models, internal red team exercises, and third-party assessments, driving remediation actions.
• Collaborate with engineers to establish secure coding standards and deliver practical security guidance.
• Enforce SSO/MFA for internal tools, manage onboarding/offboarding, and conduct access reviews ensuring auditable platform access.
• Work with the Platform team to secure AWS environments focusing on IAM policies, network configuration, secrets management, and hardening compute and data layers.
• Develop and automate security baselines for infrastructure elements including container security and CI/CD pipeline integrity.
• Conduct security architecture reviews for new systems or significant infrastructure changes.
• Build and manage detection systems covering application, cloud, and SaaS environments, including anomaly detection and alerting.
• Lead incident response activities—handling triage, containment, investigation, communication with stakeholders, and post-incident analysis.
• Create runbooks and response playbooks to ensure preparedness for security incidents.
• Support the SOC 2 compliance program through evidence gathering, control monitoring, and audit preparation.
• Perform security assessments of vendors and customers.
• Clearly communicate security risks to both engineers and leadership, prioritizing necessary remediation.
• Keep security policies and documentation updated and relevant.
• Develop the security roadmap by weighing impact and risk.
• Represent security considerations in architecture decisions.
• Mentor staff to cultivate a security-first mindset.
• Report security posture to departmental leads and others.
• Advise and contribute to internal IT and physical security efforts.

Qualifications

• At least 7 years in engineering roles with a minimum of 5 years dedicated to hands-on product, application, or security engineering.
• Experience in threat hunting, intelligence, or red team activities.
• Deep knowledge of Python/Django application security including identifying and resolving web vulnerabilities in this technology stack.
• Strong AWS cloud security expertise including IAM, network controls, and secure architecture.
• Practical experience in incident response, including having led response efforts and familiarity with on-call practices.
• Familiarity with SOC 2 or related compliance standards integrated into engineering workflows.
• Effective communication skills capable of translating risk to both technical and non-technical stakeholders.
• Comfortable working independently in a distributed, cross-timezone remote setup with good judgement on escalation.

Preferred Extras

• Previous involvement in growing a security program at a startup undergoing scale.
• Knowledge of the music industry or B2B SaaS domains, including specialized audio technologies like HLS.
• Relevant security certifications, such as OSCP, CISSP, or AWS Security Specialty.

Benefits

• Competitive compensation within a rapidly expanding startup environment.
• Four weeks of annual paid vacation.
• Two weeks of paid sick leave each year.
• Paid parental leave.
• Provision of company laptop.
• Monthly reimbursement for internet expenses.
• Allowance for home or office setup.
• Annual budget for learning and professional development.
• Flexibility to choose your preferred working style without heavy rule imposition.

Additional Information

This position is fully remote but candidates must reside and work within Australia. We value diversity and inclusion and encourage applications from all backgrounds, even if you don't meet every qualification listed. Please note, we do not accept unsolicited resumes from recruitment agencies.