Lead Security Engineer
Duetto Research6 months ago
Responsibilities
- Own Duetto’s overall security posture across cloud, product, infrastructure, IT, compliance, and customer assurance.
- Lead AWS cloud security across IAM, logging, network security, encryption, Kubernetes and container security, backups, and configuration risk.
- Partner with Engineering and DevOps to embed security into the SDLC, CI/CD pipelines, and production operations.
- Own vulnerability management using Snyk Pro, Lacework, or equivalent tools, including triage, prioritization, remediation tracking, and reporting.
- Lead major security incidents, investigations, escalations, root cause analysis, executive reporting, and incident response tabletop exercises.
- Coordinate disaster recovery tabletop exercises, backup testing, and business continuity security reviews.
- Own SOC 2 Type 2, ISO 27001, ISO 42001, and NIST CSF readiness, including the risk register, treatment plans, roadmap, and security debt backlog.
- Partner with Legal and Privacy on DPA, DTIA, DPF, GDPR, SCCs, and subprocessor management.
- Lead customer-facing security assurance, including strategic RFPs, questionnaires, enterprise security reviews, Trust page content, and sales support calls.
- Advise IT on MDM, endpoint security, AV/EDR coverage, access reviews, and SaaS security controls, and report security posture and audit readiness to executives.
Requirements
- 8+ years of experience in security, cloud security, DevSecOps, security engineering, infrastructure security, or security operations.
- Strong hands-on AWS knowledge, including the ability to review cloud architecture and identify security risks.
- Experience securing DevOps environments, CI/CD pipelines, Kubernetes and container environments, cloud IAM, logging, secrets management, and infrastructure-as-code.
- Experience with SOC 2 Type 2 audits and familiarity with ISO 27001, NIST CSF, and GDPR security requirements.
- Experience with vulnerability management, penetration testing programs, and incident response.
- Ability to translate technical risks into business priorities and communicate with Engineering, Legal, Sales, auditors, customers, and executives.
- Hands-on experience with Snyk, Lacework, Vanta, MDM platforms, endpoint protection, and cloud posture tools is preferred.
- Prior ownership of SOC 2 Type 2 audit readiness, ISO 27001 implementation or certification support, enterprise SaaS security reviews, customer trust programs, or ISO 42001 and AI governance frameworks is preferred.
Benefits
- Remote position available in the US or Canada.
- Full ownership of a consequential security program spanning security posture, compliance, incident response, and customer trust.
- Opportunity to work on AI governance and ISO 42001 alignment in an AI-first engineering organization.
- Broad technical and commercial exposure across cloud architecture, enterprise security reviews, and global hospitality customers.
Tech Stack
Categories
About Duetto Research
Duetto Research builds a cloud-based revenue management platform for hotels, resorts, and casinos, with tools for pricing, forecasting, and group business (GameChanger, ScoreBoard, BlockBuster, Advance). It sells its software as a SaaS subscription used by independent properties and global chains to optimize rates and profitability. Founded in 2012 and headquartered in San Francisco, the company is privately held and backed by GrowthCurve Capital.