Lead Security Engineer (DevSecOps & Compliance) at Zeely

Job description

Join Zeely as a Lead Security Engineer and help us strengthen and scale security across our products and infrastructure. This role combines high ownership with hands-on engineering. You’ll lead our security direction together with our DevSecOps / Security Engineer: securing our AWS environment, closing security tasks yourself, and owning our SOC 2 and ISO 27001 compliance. You’ll work closely with our Principal System Architect and the Platform, DevOps, and Backend teams as a trusted partner with real authority over technical decisions from a security perspective. About Us: Zeely is the agentic AI platform for creating, launching, and scaling paid ads. Simply put: we’ve made the best AI solutions and marketing tools available to small and medium businesses — tools that used to be reserved for big brands with expensive marketing teams. The next big step: a B2B solution for large marketing teams and enterprise clients — workflows, creative analytics, and full control over campaigns across the whole team. For companies where performance marketing already runs at scale and needs more efficiency and automation. A few numbers that speak for themselves: - 4 years on the market — a stable, profitable company backed by international investors; - 6× growth over the past year; - 2,000,000+ businesses already use Zeely; - #1 in its category in the US market; - 250+ specialists on the team; - Markets: US + worldwide. We’re not a startup searching for product-market fit — we’re a business with proven results and a clear understanding of what works. What You’ll Do: - Secure our AWS-first cloud environment hands-on: IAM and access management, secrets, hardening, and network security; - Own compliance initiatives (SOC 2, ISO 27001, CASA): implement controls, prepare evidence, and work with auditors; - Build security into CI/CD: SAST, DAST, SCA, secrets scanning, and infrastructure-as-code checks; - Find, prioritize, and fix vulnerabilities across our product and infrastructure, closing critical security tasks yourself; - Run incident response and set up monitoring and alerting; - Define and prioritize security initiatives and own the security roadmap; - Review architecture decisions and code from a security perspective; - Set up security policies and processes, and guide the DevOps and Platform teams on implementation; - Support B2B clients with security questions, reviews, and due diligence. What Do You Need to Join Us? - 7+ years of experience in DevOps, Platform, or infrastructure engineering, including at least 4 years focused on security (DevSecOps, Cloud Security, or Security Engineer); - Hands-on experience with both SOC 2 and ISO 27001: preparing for, passing, or maintaining audits, understanding the requirements behind each control, and working with auditors; - Strong hands-on experience with AWS and infrastructure as code using Terraform; - Proven experience finding and fixing vulnerabilities and handling security incidents; - Experience leading engineers or acting as a technical lead; - AWS Professional-level certification (a security-focused Associate certification may also be considered); - Upper-Intermediate (B2+) English or higher; - Fluent Ukrainian. Nice to Have: - Backend development background (Node.js / TypeScript, Java, C#/.NET, Go, or Python), or a career path from backend to DevOps/Platform to Security; - Experience with CASA assessments; - Experience implementing GDPR and/or CCPA (CPRA) requirements; - Understanding of HIPAA or PCI DSS; - Other security certifications (CISSP, OSCP, CKS) or GCP certifications. Why It’s Worth Joining Us: - Security ownership at one of the world’s leading AI companies: Zeely is #22 in a16z’s Top 50 consumer AI apps by monthly revenue; - Security is a strategic priority for the company: a direct line to the C-level co-founders, real authority over technical decisions, and a strong voice in how the product is built; - Work with cutting-edge technologies and AI-powered tools; - A strong team of A-level players who push each other to grow; - A remote-first setup with offices in Warsaw and Kyiv; - Regular performance reviews to keep your growth transparent and rewarded. Recruitment Process: Intro Call → Technical Interview → Final Interview → Reference Check → Offer. Send us your CV — we’d love to meet you!

Requirements

Must-haves

Join Zeely as a Lead Security Engineer and help us strengthen and scale security across our products and infrastructure.
4 years on the market — a stable, profitable company backed by international investors;
6× growth over the past year;
2,000,000+ businesses already use Zeely;
#1 in its category in the US market;
250+ specialists on the team;
Markets: US + worldwide.
We’re not a startup searching for product-market fit — we’re a business with proven results and a clear understanding of what works.
Secure our AWS-first cloud environment hands-on: IAM and access management, secrets, hardening, and network security;
Own compliance initiatives (SOC 2, ISO 27001, CASA): implement controls, prepare evidence, and work with auditors;
Build security into CI/CD: SAST, DAST, SCA, secrets scanning, and infrastructure-as-code checks;
Find, prioritize, and fix vulnerabilities across our product and infrastructure, closing critical security tasks yourself;
Run incident response and set up monitoring and alerting;
Define and prioritize security initiatives and own the security roadmap;
Review architecture decisions and code from a security perspective;
Set up security policies and processes, and guide the DevOps and Platform teams on implementation;
Support B2B clients with security questions, reviews, and due diligence.
What Do You Need to Join Us?
7+ years of experience in DevOps, Platform, or infrastructure engineering, including at least 4 years focused on security (DevSecOps, Cloud Security, or Security Engineer);

Nice-to-haves

Backend development background (Node.js / TypeScript, Java, C#/.NET, Go, or Python), or a career path from backend to DevOps/Platform to Security;
Experience with CASA assessments;
Experience implementing GDPR and/or CCPA (CPRA) requirements;
Understanding of HIPAA or PCI DSS;
Other security certifications (CISSP, OSCP, CKS) or GCP certifications.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

awsaici/cdnode.jstypescriptjavagopythongcp

Platform: ashby
Effort: quick