Cloudian Inc
Security Engineer — Product Security (Storage)
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
About the Job
This role owns the day-to-day execution of product security for our storage platform — you take an existing backlog and established compliance requirements and drive them to closure. Specifically: CVE response, Common Criteria certification evidence, and remediation of findings from our AppSec tooling.
Because this is a single headcount covering a broader need, the role also carries product-management-adjacent responsibilities — owning some security/compliance requirements and, over time, touching hardware-platform security considerations. Those are secondary to the core execution work, not a replacement for it.
Responsibilities
- CVE Response: Monitor, triage, and assess the applicability of published CVEs against our software and dependency stack; coordinate patch timelines with engineering owners.
- Common Criteria Certification: Prepare and maintain testing evidence for our Common Criteria certification; work with the certification lab and internal engineering to close gaps.
- AppSec Triage: Own the Jira backlog generated by our AppSec scanning tools (SAST/DAST/SCA) — validate findings, prioritize, and drive remediation with the responsible engineering teams.
- Secure SDLC Support: Contribute secure coding guidance and review support where needed.
- Compliance Support: Assist with evidence gathering for FIPS/FedRAMP where it touches storage-layer security.
- Security & Compliance Requirements (secondary): As bandwidth allows, help define requirements for encryption at rest, key management, and access control, and represent our security posture in customer/partner security questionnaires. This is scoped input, not roadmap ownership.
- Hardware Platform Awareness (secondary): As bandwidth allows, factor hardware-platform considerations (server specs, drive/controller choices) into security and compliance guidance. This does not extend to owning hardware platform strategy.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Requirements
Get help with your application
Your very own career expert that helps elevate your application to the next level.
This role is not the right fit if:
- You have no hands-on vulnerability management or secure-SDLC experience — pure coordination/PM background without technical depth won't work here.
- You're not comfortable in Linux and can't script.
- Your storage experience is limited to consuming cloud storage services (S3, Azure Blob, GCS) as a developer or architect, with no on-prem, appliance, or hardware context.
We're looking for:
- Vulnerability Management: CVE triage, CVSS scoring, and remediation coordination with engineering.
- AppSec Tooling: Experience working with SAST/DAST/SCA tool output and driving findings through to closure, not just reading reports.
- Technical Depth: Comfortable in Linux, with scripting (Python/Bash) for automation and log analysis.
- Certification Experience: Direct experience with Common Criteria, FIPS, or FedRAMP evidence/testing is strongly preferred.
- Storage Understanding: A genuine grasp of storage systems architecture (object storage, SDS, on-prem/appliance deployment) — it's what lets you tell real risk apart from theoretical risk when triaging, and what makes the secondary PM/hardware-adjacent work possible at all.
- Adaptability (secondary): Comfortable picking up requirements-writing, customer-facing security questionnaires, or hardware-security considerations as needed — you don't need prior PM title experience, but you need to be able to operate in that mode without hand-holding.
- Nice to Have: Encryption, key management, access control concepts. Prior exposure to ODM/OEM hardware qualification is a plus but not required.
- Tools: Jira; familiarity with vulnerability scanners and CVE/NVD databases.
- Education: BS in a technical field, or equivalent practical experience.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location