Senior SecOps Engineer

As a Senior SecOps Engineer at Clutch, you will shape and execute our application security and cloud security posture. You will work embedded in engineering, driving secure by design practices, threat modeling, and proactive risk mitigation across our applications and cloud infrastructure. This is a hands-on role for someone who loves building secure systems and influencing security culture in a fast-paced fintech startup.

You will act as a key advisor on secure architecture. You will own the work of identifying, fixing, and preventing vulnerabilities across our services, cloud environments, tooling, and developer workflows.

What You’ll Do

Within 1 month, you will:

• Assess our application and cloud security posture, and map the highest risks across services, cloud accounts, and pipelines.
• Embed with engineering teams to review security-critical features and give practical guidance on secure design.
• Integrate developer-friendly security tooling (SAST, SCA, secret scanning, IaC scanning) into our CI/CD pipelines.
• Triage and remediate early vulnerabilities, and set a baseline for secure coding and cloud hardening.

Within 3 months, you will:

• Lead the design and rollout of a Secure SDLC with actionable security gates and clear ownership at each stage.
• Establish cloud security controls, including IAM least privilege, secrets management, and logging for threat detection.
• Build internal tooling to automate threat detection, cloud posture monitoring, and vulnerability management.
• Launch an internal security playbook with incident response runbooks tailored to Clutch’s tech stack.

Within 6 months, you will:

• Develop and maintain secure libraries and frameworks used across engineering, such as auth modules and input validators.
• Drive continuous cloud security improvements through policy as code, automated compliance checks, and drift detection.
• Build and mentor a security champion network inside engineering teams.
• Partner with developers to threat model new services and cloud architecture changes.

What You’ll Bring

• 5+ years of experience in software/application security, ideally in fast-growing startups or fintech environments.
• Deep knowledge of web application security, secure software design, API hardening, and threat modeling.
• Experience integrating security into CI/CD pipelines, including use of SAST, DAST, SCA, and IaC scanning tools.
• Familiarity with common compliance frameworks (e.g., SOC 2, GLBA, PCI-DSS) and cloud-native security (AWS, GCP preferred).
• A strong coding background (e.g., Node.js, Python, Go) and the ability to read, understand, and debug code securely.
• Excellent communication skills, with the ability to influence without authority and foster cross-functional collaboration.