Senior Security Engineer - Application & Cloud Security

Job Description:

Senior Security Engineer - Application & Cloud Security(Draper Utah, In-Office)
ABOUT UPBOUNDUpbound Group, Inc. (effective February 27, 2023: NASDAQ: UPBD) is an omni-channel platform company committed to elevating financial opportunity for all through innovative, inclusive, and technology-driven financial solutions that address the evolving needs and aspirations of consumers. The Company’s customer-facing operating units include industry-leading brands such as Acima, Rent-A-Center, and Brigit that facilitate consumer transactions across a wide range of store-based and digital retail channels, including over 2,400 company branded retail units across the United States, Mexico and Puerto Rico.

Upbound Group, Inc. is headquartered in Plano, Texas.

ABOUT THE POSITION You will play a critical role in securing modern cloud-native applications, CI/CD pipelines, APIs, infrastructure, and development ecosystems across the enterprise. The ideal candidate is a cybersecurity-minded engineer who previously worked as a software developer, Dev Ops engineer, platform engineer, or infrastructure engineer and still possesses strong coding and system-level troubleshooting skills. This role requires someone who can read and understand source code, work closely with engineering teams, threat hunt across modern environments, and help build scalable security capabilities directly into the software development lifecycle.

This position will work across Application Security, Cloud Security, and Engineering teams to help secure enterprise applications and cloud infrastructure , operating  RESPONSIBILITIES Work directly with software engineers, Dev Ops engineers, architects, and leadership to identify , prioritize, and remediate security vulnerabilities across applications and cloud environments.

Perform hands-on application security reviews, source code analysis, threat modeling, and architecture reviews for modern applications and APIs.Build, integrate, automate, and operationalize security controls within modern CI/CD pipelines.

Secure Infrastructure as Code ( IaC ) environments using Terraform, Cloud Formation, Kubernetes, and related technologies.

Develop and maintain automated security tooling and workflows across SAST, DAST, SCA, secrets scanning, container security, and cloud security platforms.

Support incident response, threat hunting, forensic investigations, and remediation activities related to application and cloud environments.

Identify and remediate security weaknesses involving APIs, authentication systems, secrets management, cloud infrastructure, containers, and microservices.

Work closely with engineering teams to establish secure-by-default engineering practices and security guardrails.

Assist with implementing and tuning WAF, API security, identity platforms, cloud security tooling, runtime protection, and logging/monitoring capabilities.

Help operationalize modern security practices around: SSDLC, Software supply chain security, Cloud-native security, Threat detection and response

Participate in security investigations involving fraud, insider threats, suspicious application activity, and cloud incidents.

Provide technical leadership and mentorship across engineering and security teams.

JOB REQUIREMENTS/QUALIFICATIONS5+ years of experience in Application Security, Dev Sec Ops  , Cloud Security, Software Engineering, or related technical disciplines.

Previous hands-on experience as a software developer, Dev Ops engineer, platform engineer, infrastructure engineer, or similar engineering role.

Experience securing modern CI/CD environments and integrating security into engineering workflows.

Strong experience with Infrastructure as Code ( IaC ), including Terraform, Cloud Formation, Kubernetes, Helm, or similar technologies.

Experience with public cloud platforms such as AWS, Azure, or GCP.Hands-on experience with security tooling such as: SAST, DAST, SCA, etc Understanding of OWASP Top 10, API security risks, cloud-native security threats, identity security, and modern attack techniques.

Experience investigating and remediating vulnerabilities involving applications, APIs, authentication systems,…