Security Engineer- Application & Cloud

About Zello

Zello is a voice-first communication platform, powered by our industry-leading push-to-talk technology, to improve collaboration and productivity for desk-less workers. With over 175+ million users, we're the #1 rated push-to-talk app in the world, delivering 9 billion messages a month. At Zello, our company values are at the heart of what we do everyday. We're proud to serve the frontline, we're privileged to connect people in times of crisis across the globe, and we're honored to support first responders.

Zello keeps frontline teams connected with instant voice, on a platform trusted by public safety, healthcare, utilities, and large retail. Our Security Engineering function has proven that AI can multiply security signal: our AI security reviewer is now our largest source of findings. The bottleneck has moved from detection to triage and remediation. You'll be the second security engineer, splitting an operate/build rotation with the Director of Security Engineering and building the automation that lets security scale without scaling headcount.

Responsibilities

• Take your turn on interrupt duty (findings triage, access questions, incidents, and customer security assessments), then swap to protected build time.
• Tune the AI security reviewer and triage agents, and decide which calls stay with a human owner.
• Build the intake pipeline that routes findings from the AI reviewer, bug bounty, pen tests, and audits to the teams that own the code, with SLA clocks per severity.
• Lead the Google Cloud hardening project across IAM, org policy, and workload configuration.
• Choose and roll out code scanning and supply chain controls in GitHub and CI/CD, and make sure engineers can act on what the scanners find.
• Review code and designs that touch authorization, identity, and tenancy, and push fixes through Platform, Web, and Backend teams.
• Write the runbooks and requirements that let anyone on the team run a security process without you.

Requirements

• You've built and shipped security automation in code, and you can walk us through something you wrote that still runs in production.
• You've applied LLMs or agents to real security work, and you have opinions about where AI output needs a human owner.
• You can read application code and spot an exploitable authorization, identity, or secrets flaw, then explain it to the team that has to fix it.
• You've rolled out security scanning in CI and turned the results into fixes, not just dashboards.
• You've secured IAM and workloads in a major cloud. GCP is ideal; AWS or Azure is fine.
• You get fixes shipped by teams you don't manage, and engineers describe working with you as straightforward.
• You learn fast and go broad. You're comfortable moving between incident mode and build mode in the same week.

What This Role Is Not

• A people management role or the first step toward building a large security team.
• A GRC or compliance role. Governance and audit programs sit with our CISO.
• A 24/7 SOC role. Off-hours infrastructure monitoring stays with our MDR partner.
• An IT helpdesk role. Day-to-day SaaS provisioning belongs to Ops.

Benefits

We have competitive pay, equity with significant upside, and intentionally design our benefits to encourage healthy and well-balanced employees, flexible schedules and time off. We even offer a sabbatical after every five years of service so you're able to pursue and enjoy what matters most to you. And of course, we wouldn't be a technology company without a ping-pong table and free snacks in our break room.