Security Engineer
Reposted 2× across DOU + Djinni — deduped to one listing.
metahunt matched 2 postings of this exact role by semantic similarity, so you see it once instead of 2 times.
Security work at Headway Inc already happens across Infrastructure and Engineering, but no one owns it end to end. We’re looking for a systems or infrastructure engineer who is ready to make security their main craft and become our first dedicated Security Engineer. You’ll own identity, endpoints, cloud security, and incident response hands-on, with AI as your main tool, report directly to the CTO, and decide how security works here from day one.
About Headway Inc
Headway Inc is a global tech company building products that help people grow. Our apps have reached 170M+ downloads worldwide, and TIME ranked Headway Inc #4 among the World’s Top EdTech Companies.
Our achievements start with our people and the values we share. At Headway Inc, we believe in building strong teams around our SELECT values.
Millions of people trust our apps with their learning, and around 500 teammates rely on their accounts, devices, and cloud systems to keep building them. Your job is to keep all of that protected in a way that’s practical and doesn’t slow anyone down.
What you’ll do
- Identity and access: Own SSO, MFA, and the access lifecycle, so every account has the access it needs and nothing more.
- Endpoints and email: Run endpoint security (MDM, EDR) across our devices and keep phishing out with SPF, DKIM, and DMARC.
- Cloud security: Work hands-on with GCP security controls and make sure our logs show us when something goes wrong.
- Detection and incident response: Run detection together with an external MDR/SOC provider and own the incidents they escalate: make the calls, contain the issue, and find the root cause.
- AI-first automation: Use AI as your main tool to automate routine security work.
- Risk and communication: Prioritize by business impact and explain risks and trade-offs to Engineering, Operations, and leadership.
You’ll report to Rostyslav Vasiukov, our CTO, and work closely with IT Infrastructure, Core Platform, and teams driving AI adoption. Your role isn’t to execute every security task alone, but to set risk-based priorities, establish clear ownership, align teams, and ensure we address the most important risks.
What success looks like
- First result: Within your first 3 months, you know our environment and how well our existing controls work. You’ve agreed on the top security risks with the CTO and closed the most urgent gaps, starting with endpoint security.
- Tangible progress: By 6 months, access management, endpoint security, and visibility across our systems work reliably, so we notice when something goes wrong.
- Longer-term impact: Within a year, corporate security runs as a coherent, largely automated system, and leadership has a clear picture of the main risks. With that foundation in place, you’re actively involved in application security work alongside Core Platform.
You’d be a great fit if you
- Have decent experience in systems or infrastructure engineering, with real ownership of production or corporate systems.
- Have hands-on experience with corporate security basics: SSO/MFA and identity providers, MDM/EDR, and email authentication (SPF, DKIM, DMARC). You don’t need to have held a security title. Having done this work in other roles counts.
- Have worked with GCP or another major cloud provider, including IAM, logging, and monitoring, and you understand how core cloud controls fit together.
- Have handled real incidents: you investigated, contained the problem, found the root cause, and made sure it didn’t happen again.
- Are a heavy AI user. You use AI tools daily to analyze, automate, and get work done faster, and can show real examples of workflows you’ve built. Scripting (Python, Bash, or similar) and infrastructure as code (e.g., Terraform) help, but AI fluency matters more.
- Assess risk in a business context. You know an exposed admin credential matters more than a stale test account, and you prioritize accordingly rather than following a checklist.
- Are hands-on by default. You’re comfortable doing many different tasks yourself and want to grow deliberately into security as your specialization.
- Can explain a security risk clearly to an engineer, a manager, or leadership, and communicate confidently in English, both written and spoken.
- Align with our team values, SELECT, and put them into practice in the way you work, make decisions, and collaborate with others.
It would be a plus if you also have:
- Experience with WAF and DDoS protection (e.g. Cloud Armor).
- Experience writing and tuning detection rules in SIEM/EDR.
- Experience with GitLab security tooling, CI/CD, and security control automation.
- Experience selecting, onboarding, or working with an MDR/SOC provider.
- Understanding of AI Security risks: sensitive data handling, access control, third-party AI tools, and AI-enabled product features.
- Product Security / Application Security: secure SDLC, threat modeling, code and dependency scanning.
- Security awareness programs, tabletop exercises, and human risk management.
What we offer
- Two week-long paid corporate holidays each year and 20 vacation days.
- Medical insurance, full sick leave compensation and access to a corporate doctor.
- A personal development plan, professional communities and a knowledge base.
- Compensation for English-language learning, external training and courses.
- An office with a reliable shelter, generators, satellite internet, and other amenities.
- Sports activities, including running, yoga, boxing and more.
- Supporting initiatives that help Ukraine. Find out more about our projects here.
We’ve created a Talent Guide to help you navigate our hiring process with clarity and confidence — and get the most out of each stage. Take a look here.