Cyber Security Engineer (13 Years Experience)
ThetaZero is a boutique technology company specializing in secure, cloud-native, AI-powered solutions for global clients.
We are looking for a hands-on Cybersecurity Engineer who can strengthen our internal and external security posture, take complete ownership of our cyber hygiene, and ensure our growing product ecosystem is secure by design.
This is a role for someone who loves security, wants to work closely with founders and engineering teams, and is excited to build security from the ground up in a fast-scaling environment.
What You Will Own
1. Internal Security (Operational Security)
- Endpoint protection: manage Sophos EDR, triage alerts, and isolate devices when needed.
- Email security: phishing protection, DMARC/SPF/DKIM validation, phishing simulations.
- Ransomware defence: backups, isolation playbooks, recovery testing.
- Daily monitoring: logs from endpoints, laptops, internal network, outbound traffic.
2. External Security (App, Cloud & Network Security)
- Secure our Node.js, Express, React apps before production:
- OWASP Top 10
- Secure headers
- API hardening
- Rate limiting
- Dependency scanning (npm, pip, Snyk, etc.)
- Secure databases (MongoDB Atlas / CosmosDB): RBAC, private endpoints, audit logs.
- Cloud Security (AWS / Azure / GCP):
- Secure cloud networks (VPC/VNET, subnets, routing, firewall rules).
- Implement IAM security (least privilege, MFA, RBAC, access governance).
- Protect secrets using Key Vault / KMS / Secret Manager.
- Configure private endpoints, security groups, and network isolation.
- Assist teams with secure CI/CD pipelines across any cloud environment.
- Secure CI/CD and infrastructure pipelines.
3. Threat & Vulnerability Management
- Track CVEs relevant to our tech stack (Node.js, React, MongoDB, Python, Azure).
- Keep libraries and packages updated (dependency health monitoring).
- Perform regular vulnerability scans (DAST/SAST) and coordinate fixes.
4. Compliance & Governance
- Implement security policies, asset inventory, and access control process.
- Help with audits, documentation, risk tracking, and incident response playbooks.
Who We Are Looking For
Must-Have Skills
- Strong fundamentals in Application Security, Network Security, and Cloud Security.
- Experience securing web apps (Node.js, React) and APIs.
- Experience with Cloud (VNETs/VPCs, IAM, Key Vault, Private Endpoints, NSGs).
- Good understanding of SIEM, log analysis, and incident response.
- Hands-on with Linux, networking, firewalls, and endpoint protection tools.
- Ability to monitor alerts and respond quickly with minimal guidance.
Good-to-Have Skills
- Knowledge of ISO 27001 / SOC2
- Experience with SAST/DAST tools
- Exposure to Azure Sentinel, Wazuh, ELK, or similar SIEM
- Understanding of DevSecOps principles
Your Mindset
- You treat security as your ownership not a checklist.
- You stay updated with CVEs and emerging threats.
- You enjoy investigating root causes, not just fixing symptoms.
- You communicate clearly with developers, founders, and Ops teams.
What You'll Get at ThetaZero
- Build security foundations for multiple cloud-native, AI-first products.
- Freedom to set standards, introduce tools, and lead cyber initiatives.
- A fast-paced, respectful environment where security is truly valued.
