Security Operations Lead

Mend.io is a company specializing in application security, focusing on AI Native AppSec Platform. The company helps global enterprises secure software, including open source, custom code, and AI-generated components. Mend.io is committed to building an inclusive workplace and supports professional development.

• 6+ years experience in Security Operations, Cloud Security, Product Security, or a similar role.
• Hands-on experience with cloud security technologies, vulnerability management, incident response, SIEM, WAF, CSPM, and IAM.
• Experience working closely with Engineering and Product teams.
• Familiarity with SOC 2, ISO 27001, and security compliance frameworks.
• Strong analytical, communication, and cross-functional collaboration skills.
• A practical, hands-on approach with the ability to balance security risk and business needs.

Nice to have:

• SOC 2
• ISO 27001
• NIST

• Assess security risks across Mend.io’s product and cloud infrastructure and drive a prioritized improvement plan.
• Own day-to-day cloud and infrastructure security operations, including SIEM/SOC monitoring, WAF, CSPM, access reviews, encryption, and secrets management.
• Lead vulnerability management, including Mend’s HackerOne bug bounty program and remediation coordination with Engineering.
• Lead security incident response and support disaster recovery planning and testing.
• Support customer-facing security activities, including questionnaires, RFPs, and technical security discussions during sales cycles.
• Drive audit and certification activities, including SOC 2 and ISO 27001/27701/27017, and maintain compliance controls and evidence through Drata.
• Manage third-party security assessments and support security and AI governance.
• Serve as a key internal security advisor for teams across the company.
• Own and improve security tooling, automation, and operational processes.