Responsibilities
- Drive security integration across all phases of the software development lifecycle, from design through deployment.
- Partner with development teams to implement scalable application security controls, standards, and guardrails.
- Promote secure-by-design principles across web, mobile, cloud, APIs, and distributed systems.
- Lead threat modeling exercises and security design reviews for high-impact systems, services, and product features.
- Conduct architectural reviews and risk assessments for new capabilities, services, and major design changes.
- Build and improve security automation within CI/CD pipelines.
- Integrate and optimize application security tooling including SAST, DAST, SCA, secrets scanning, infrastructure-as-code scanning, and API security controls.
- Develop reusable security patterns, libraries, and automation to reduce developer friction.
- Review and prioritize application security findings from internal testing, third-party assessments, and VAPT exercises.
- Guide engineering teams on vulnerability remediation and secure coding improvements.
- Develop secure coding guidance, patterns, and developer-facing best practices.
- Partner with product, engineering, cloud security, and infrastructure teams to identify and remediate security risks early.
- Participate in security education initiatives and promote a strong security culture across engineering.
Requirements
- Bachelor’s or master’s degree in computer science, cybersecurity, or a related field, or equivalent experience.
- 6–9 years of experience in application security, product security, DevSecOps, or security engineering.
- Strong understanding of information security fundamentals and ability to communicate them clearly to engineering and product teams.
- Hands-on experience with secure coding, DevSecOps, and security automation.
- Familiarity with application architecture, threat modeling, CI/CD pipelines, infrastructure as code, serverless systems, and identity and access management.
- Experience integrating security controls into developer workflows.
- Proficiency in at least one programming or scripting language such as Python, Bash, Java, JavaScript, or Go.
- Experience with OWASP Top 10, OWASP ASVS, API security, and modern software assurance practices is preferred.
- Experience reviewing code and supporting remediation across modern application stacks is preferred.
- Penetration testing experience is optional; ability to interpret findings is required.
- Relevant industry-recognized certifications are a plus.
Benefits
- Competitive compensation (amount not specified).
- Generous stock options.
- Medical insurance coverage.
- Opportunity to influence secure engineering practices across a modern product organization.
- Ownership of impactful security initiatives at scale.
- Innovative, collaborative, and fast-paced culture.
Tech Stack
Categories
About Tekion
Tekion is redefining automotive retail with an end-to-end, AI-native platform purpose-built for the industry. With AI built into every workflow, Tekion delivers intelligent automation, real-time insights, and advanced decision support—driving measurable efficiency, revenue, and modern consumer experiences. As the first and fastest cloud-native platform for automotive, Tekion unites OEMs, dealers, partners, and consumers through its revolutionary suite of solutions: Automotive Retail Cloud (ARC) for retailers, Automotive Enterprise Cloud (AEC) for manufacturers and large enterprises, and Automotive Partner Cloud (APC) for technology and industry partners. Together, these offerings connect the entire ecosystem on a single, AI-native platform that empowers teams to operate smarter, serve faster, and scale more profitably. With AI-powered, cloud-native technology, Tekion is enabling the most seamless, transparent, and profitable retail experiences in the industry—helping automotive businesses transform how they operate today and prepare for what’s next.