Staff Security Engineer

Core Responsibilities

• Application & Platform Security
• Maintain a current inventory of applications, services, and data flows across Redbubble, TeePublic, FranklyWearing, and Dashery.
• Run and tune security assurance across the delivery lifecycle - SAST, DAST, dependency/SCA, container and infrastructure scanning - integrated into CI/CD, not ad hoc.
• Triage findings from automated tooling and external penetration testing (e.g. Cobalt) against defined remediation SLAs (e.g. critical ≤ 7 days, high ≤ 30) and track them to closure.
• Build security champions in delivery teams so security scales beyond one person.
• Compliance, PCI & Control Operations
• Drive PCI DSS activities within DEAP's scope: CDE scope definition, SAQ/ROC completion, quarterly ASV scans, segmentation evidence, and audit liaison.
• Run the audit calendar so evidence is collected continuously, not assembled under pressure.
• Maintain a working risk register - owners, due dates, treatment decisions, review cadence — and report risk and compliance status to leadership in business terms.
• Partner with legal and privacy on GDPR/CCPA-adjacent technical controls: retention, deletion, and access.
• Support access governance: joiner/mover/leaver process, quarterly recertification of production and admin access, and least-privilege IAM.
• Security Incident Response
• Own and improve the security incident process end to end: severity definitions, escalation paths, comms templates, and response coordination.
• Act as incident commander for security-led and security-relevant incidents.
• Ensure post-incident reviews are blameless, specific, and tracked to completion.
• Partner with Infrastructure and DevOps on handoffs between security response and production reliability response.
• Bot, Log & Signal Stewardship
• Own bot management proactively: monitor bot load and cost impact (e.g. Cloudflare) and tune mitigation with relevant teams and vendors ahead of overages, not after them.
• Improve logging hygiene and drive toward zero-error logs — errors triaged and reduced over time, not tolerated as background noise.