About the company
DISCO is the industry standard for managing, organising and sharing music and other media. Customers include UMG, Sony, Warner Music, Netflix, and Amazon. We are a SOC 2-compliant SaaS company in the music industry.
Responsibilities
- Lead security engineering for our Python/Django/React application, including code reviews, threat modelling, and security design reviews
- Own static analysis, dependency scanning, secret scanning in CI and triage of findings
- Coordinate penetration testing and drive remediation of findings
- Partner with engineers to set secure coding standards
- Enforce SSO/MFA for internal tooling, manage on/offboarding and access reviews
- Secure AWS environment: IAM, network architecture, secrets management, compute/data layer hardening
- Define and automate security baselines for infrastructure, container security, and CI/CD pipeline integrity
- Build and maintain detection capabilities across application, cloud, and SaaS stack
- Manage security incident response: triage, containment, investigation, communication, post-incident review
- Contribute to SOC2 compliance program: evidence collection, control monitoring, audit readiness
- Conduct vendor and customer security assessments
- Define the security roadmap and mentor engineers on security
Requirements
- 7+ years in engineering and 5+ years of hands-on security experience in product/application security or security engineering
- Experience with threat hunting, threat intelligence, or red team activities
- Strong Python/Django application security knowledge
- Solid AWS cloud security experience covering IAM, network controls, and secure architecture patterns
- Practical incident response experience, including being on call
- Working knowledge of SOC2 or comparable compliance framework
- Ability to communicate risk clearly to technical and non-technical audiences
- Comfort working autonomously in a remote, cross-timezone environment
- Bonus: experience building a security program at a scaling startup, familiarity with music industry or B2B SaaS (HLS), certifications such as OSCP, CISSP, AWS Security Specialty
Conditions
- Remote position open to applicants who live and work in Australia
- Competitive salary in a fast-growing startup
- Four weeks of paid vacation leave per year
- Two weeks of paid sick leave per year
- Paid Parental Leave
- Company laptop
- Monthly internet allowance/reimbursement
- Office set-up allowance
- Annual learning and development allowance