Being a Head of Security at balena

Our users trust us to provide critical infrastructure for their distributed IoT fleets, and our engineers work hard to protect each of these devices from attacks. Our “security stack” spans from the bootloader and OS on-device, to the network and security infrastructure of our backend, to the operational security of our team.

As a Head of Security, you will learn how our complex interdependent systems are built and run. You will dig deep into diagnostics & debugging surfaces, logs, and reports to identify areas of risk and strategies to minimize vulnerabilities. You will develop and deploy security controls and concepts stretching from cloud- based apps to systems running on embedded devices, and lead initiatives to create new frameworks and roadmaps. You will influence infrastructure and product decisions and, above all, establish and promote a culture of shared responsibility for security.

Responsibilities

• Analyze weaknesses and attack patterns, and architect solutions to address them


• Construct a comprehensive threat model that includes a variety of actors and security contexts


• Define standards and streamline workflows for managing incidents, recovery, and vulnerability reports


• Implement, tune, and enhance security auditing, monitoring, and notification systems


• Perform checks to ensure our production pipeline is secure — from developer machines to servers


• Design and review security-related product features, like automated vulnerability scanning and audit logs


• Be a key resource for peers on support, share knowledge and mentor others on best practices

Requirements

• Strong technical background in software development, operations and/or information security


• Experience writing high-quality code and debugging production systems


• Working knowledge of Linux operating system internals


• Awareness of classic and emerging threat actor tactics, techniques, and procedures in both pre- and post-exploitation phases of attack lifecycles


• Ability to manage ambiguity, push through friction, and independently make critical trade-off decisions


• Continuous improvement mindset and desire to make yourself and others more effective


• Willingness to constantly build on your knowledge of the platform and new technologies


• Excellent communication skills and fluency in English

Bonus points

• Proficiency in at least one high-level language (we use Typescript and Javascript)


• Knowledge of state of the art authentication standards such as OIDC


• Good understanding of networking (TCP/IP) and higher-level HTTP & TLS protocols


• Background in leading teams and working across functions to build secure products


• Experience with IoT, embedded SW, dev tools, or balena as a user/contributor


• Contributions to OSS projects and community involvement

Make sure to let us know if any of these items apply to you! If possible, please also share a sample of your work or examples of projects (URL or attachment).