DevSecOps/AppSec Engineer - Ladder

About Ladder

We saw a problem within the life insurance industry: getting covered took too long, involved too much paperwork, and required too many in-person meetings with sales agents. Having lost his father at a young age, our CEO, Jamie, was determined to make it easier for people to get the coverage they needed to provide for their families. So, we got to work. We developed a method of real-time underwriting leveraging AI and, in doing so, reduced the months-long process of applying for life insurance to minutes. Our digital experience is quick (instant decisions!), loved by users, and prolific ($74 billion+ in coverage provided).

Please note: This is a remote role based in one of the 23 US states Ladder is currently hiring in: AZ, CA, CO, CT, FL, GA, IA, KS, MA, MD, MN, NC, NH, NJ, NV, NY, OH, OR, PA, TX, VA, WA, WI (excluding SF Bay Area, NYC, and Seattle). Ladder is not currently sponsoring or transferring OPT or H1-B visas.

About the Role

We are looking for a Security Engineer / Analyst who brings a rare blend of application security engineering and risk management maturity. In this role, you will be the driving force behind our vulnerability management lifecycle, balancing day-to-day security operations with development-facing vulnerability management and compliance.

Your primary mission will be embedded within our development lifecycles, taking ownership of application security vulnerability management for our engineering teams. Because our backend infrastructure runs heavily on Clojure, you won't just be running automated scanners—you will actively inspect code and leverage your functional programming experience to strengthen our shift-left security philosophy. Beyond AppSec, you will monitor our cloud infrastructure, respond to alerts, conduct security risk reviews, support compliance audits, and ensure our day-to-day workspace remains locked down.

What You'll Do

• Secure the Code (Primary): Partner directly with development teams to champion application security vulnerability management. Triage vulnerabilities within a high-scale Clojure ecosystem and assist with remediation code fixes.
• Security Ops: Configure, fine-tune, and monitor our cloud security posture leveraging Security Operations tools (SIEM, SOAR, CSP, CNAPP) to detect and respond to threats in real time.
• Champion Governance & Risk: Conduct thorough Security Reviews and risk assessments on internal architecture, third-party vendors, and APIs to ensure alignment with corporate risk tolerance and compliance standards.
• Protect the Workspace: Maintain and optimize day-to-day corporate workspace security, ensuring identity access management, device compliance, and productivity tools are highly secure yet frictionless.
• Drive Technical Excellence: Act as a security advocate across teams. Mentor engineers on secure coding practices, establish secure defaults, and make practical risk decisions that scale with growth.

Experience Required

• Experienced Security Professional: 4+ years of software engineering and/or cybersecurity experience, backed by a strong foundation in Computer Science, Cyber Security, or a related field.
• Clojure-Capable: Hands-on experience coding in Clojure and working within the JVM environment. Comfortable reading functional code, understanding immutable data structures, and collaborating directly with backend engineers on code-level fixes.
• Cloud SecOps Practitioner: Hands-on experience securing modern cloud infrastructures and working in incident response.
• Autonomous Systems Thinker: Ability to look for the root cause of issues to design security frameworks that prevent entire classes of vulnerabilities from occurring.
• Certified Professional: Baseline certifications such as CompTIA Security+ or equivalents. Advanced credentials like CISSP are highly preferred.

Technologies Used

• Backend & Code: Clojure, JVM, TypeScript, JavaScript
• Cloud & Infrastructure: GCP, Kubernetes, Docker, Terraform, GraphQL
• Security & Data Operations: Google Security Command Center, Chronicle, Datomic, BigQuery, Kafka

What We Offer

• Medical, Dental, & Vision Coverage: Competitive healthcare coverage for you and your family.
• Flexible Paid Time Off: Take the time you need to rest and recharge, plus a week-long winter holiday closure.
• Stock Options: Competitive equity packages to participate in Ladder's growth.
• 401(k) Match: Up to 4% matching on 401(k) contributions.
• Ladder Fit Program: Monthly stipend for wellness-related expenses.
• Paid Parental Leave: 10 weeks of paid baby bonding for all new parents (birthing, adoption, or fostering).
• Work-From-Home Support: One-time remote office setup stipend plus a monthly stipend to cover internet and WFH costs.
• Company Events: Virtual social events and team gatherings.