Security Engineer II

The posting, as Spotnana wrote it

Let’s build what’s next, together.

We are Spotnana. We’re on a mission to modernize the infrastructure of the $11.7 trillion travel industry to power the perfect trip for travelers everywhere. Our Travel-as-a-Service platform is designed to make every trip better, whether someone is booking for work or leisure travel, building a travel tool, or looking to offer personalized experiences at scale.

We’re not just modernizing tech, we’re rethinking how the industry works. And to get there, we’re bringing together innovative, ambitious, and open-minded people who want to build something that lasts.

At Spotnana, our values and principles guide how we work and grow together:

• Build the future – We are leaders, we are innovators, we are ambitious.
• Commit to excellence – We’re accountable, we are partners, we are agile.
• Stronger together – We lead with respect and integrity, we are inclusive, we are lifelong learners.

The opportunity ahead
Spotnana is seeking an Security Engineer II to join our global Security team. As an Security Engineer II focused on Application Security, you will be responsible for improving Spotnana’s security and privacy position across our platform. As a hands-on engineer, you will work closely with Spotnana Engineering and Product teams to expand our secure SDLC, own our API security and penetration testing processes, and advocate for best-practices across our codebase including incorporation of security reviews earlier in our development cycle. The ideal candidate has a strong engineering background and is passionate about working cross-functionally with R&D teams to deliver secure, scalable solutions while being able to describe the business value provided by reducing risks.

How you'll help us build

• Conduct application level security assessments (threat modeling, code reviews, penetration testing) of both internal tools and external Spotnana web and mobile applications
• Provide supporting guidance for bug-fixes on issues found through various channels (customer reported, internal testing, tools, external pen tests etc)
• Incorporate AI tools to accelerate our ability to detect and address application security vulnerabilities
• Develop API Security best practices
• Implement SAST, DAST, RAST, IAST and related tools to identify security bugs earlier in the release cycle
• Deliver training and awareness forR&D on security issues
• Be part of incident response team where application level context and triage is necessary to contain an issue
• Collaborate with security compliance functions to align technical controls with compliance requirements

Experience you bring

• 3+ years of previous web and mobile application security assessment experience
• Experience securing Java-based, API -driven microservices deployed in a cloud environment
• Experience with React (JS) for frontend and Java for backend services
• Previous experience implementing secure SDLC practices, and automations such as SAST, DAST, RA

[…]
e-tax and ROTH 401(k) options via Fidelity with up to a 4% company match

• Comprehensive benefit plans covering medical, dental, vision, life, and disability effective on your hire date. We cover 100% of your employee premiums and 85% of your eligible dependents
• Pre-tax flexible spending account options for health, dependent care, and commuter expenses
• Flexible PTO in addition to 10 company holidays and an end-of-year company shutdown
• Up to 26 weeks of Parental Leave
• Monthly cell phone/internet stipend
• Extra perks — IATAN travel membership, pet insurance, financial wellness tools, Calm app access, and more

We are committed to fostering a diverse, inclusive environment and to encourage these values in everyone on our team. We provide an environment of mutual respect where opportunities are available without regard to race, color, religion, sex, pregnancy (including childbirth, lactation and related medical conditions), national origin, age, physical and mental disability, marital status, sexual orientation, gender identity, gender expression, genetic information (including characteristics and testing), military and veteran status, and any other characteristic protected by applicable law. We believe that diversity and inclusion for people from all walks of life is key to our success as a company.

Protect yourself from recruitment scams - All recruiting outreach and communication comes directly from our internal team via an email with an @spotnana.com address or through LinkedIn. We encourage candidates to verify the source of any outreach before sharing personal information. We do not use external recruiting partners for our hiring efforts or Microsoft Teams for interviews. We will never ask you to pay for equipment, training, visa fees, or anything else during the hiring process. We do not extend offers via text-based apps or use Microsoft Teams for interviews. All legitimate openings are listed at https://www.spotnana.com/careers/careers-listing/ .