Recorded Future
Cloud Security Engineer, Product Security
At a Glance
About This Role
With 1,000+ intelligence professionals serving over 1,900 clients worldwide, Recorded Future is the world’s most advanced, and largest, intelligence company!
Recorded Future is looking for a Cloud Security Engineer, Product Security to be a vital member of the Infrastructure part of the Product Security team dedicated to supporting all facets and functions of infrastructure Security across Recorded Future. This role is highly collaborative and technical, demanding a proactive approach to embedding security throughout the product development lifecycle and operational processes. The core mission is to safeguard our product infrastructure through a blend of preventative design, responsive investigation, and continuous improvement of security controls.
What You’ll Do:
- Design and Implement Security Solutions: Take ownership of designing, building, and deploying robust, scalable security solutions and infrastructure components. This involves selecting, configuring, and integrating security tools and technologies that enhance the overall security posture of our products and platform, ensuring security is "baked in," not "bolted on."
- Cloud Security Management: Secure our cloud environments by implementing and maintaining robust security controls, monitoring configurations, and ensuring compliance with best practices to protect our infrastructure.
- Security Architecture and Design Review: Serve as a security subject matter expert during the development process in our cloud environments. Conduct comprehensive security reviews, threat modeling, and risk assessments for all proposed new features, architectural changes, and major system updates. Provide actionable feedback to engineering teams to ensure designs meet stringent security standards and comply with internal policies and external regulations.
- Engineering Collaboration and Guidance: Work hand-in-hand with software engineers, DevOps teams, and product managers across the organization. You will offer expert security guidance, answer complex security-related questions, troubleshoot implementation issues, and mentor engineers on secure coding practices and security design principles, fostering a culture of security awareness.
- Product Security Team Participation: Contribute to the Product Security team's daily operational tasks, including maintaining security documentation, managing security-related tickets, participating in on-call rotations as required, and driving initiatives to improve team processes and efficiency.
What You’ll Bring:
- 3+ years of proven relevant professional experience
- Strong cloud security knowledge, preferably AWS or GCP
- Strong foundational knowledge of security principles
- Solid Linux knowledge
- Kubernetes knowledge is a plus
- Background in coding/scripting is desired, preferably Go and/or Python
- A keen interest in finding and balancing security needs with developer productivity
- Excellent communication skills and the ability to effectively build relationships across different teams
- A strong ability to assess risks and make informed decisions
- Experience with Infrastructure-as-Code
Why should you join Recorded Future?
Recorded Future employees (or “Futurists”), represent over 40 nationalities and embody our core values of having high standards, practicing inclusion, and acting ethically. Our dedication to empowering clients with intelligence to disrupt adversaries has earned us a 4.6-star user rating on G2 and more than 50% of Fortune 100 companies as customers.
Want more info?
Blog & Podcast: Learn everything you want to know (and maybe some things you’d rather not know) about the world of cyber threat intelligence
Linkedin, Instagram & Twitter: What’s happening at Recorded Future
The Record: The Record is a cybersecurity news publication that explores the untold stories in this rapidly changing field
Timeline: History of Recorded Future
Recognition: Check out our awards and announcements
We are committed to maintaining an environment that attracts and retains talent from a diverse range of experiences, backgrounds and lifestyles. By ensuring all feel included and respected for being unique and bringing their whole selves to work, Recorded Future is made a better place every day.
If you need any accommodation or special assistance to navigate our website or to complete your application, please send an e-mail with your request to our recruiting team at careers@recordedfuture.com
Recorded Future is an equal opportunity and affirmative action employer and we encourage candidates from all backgrounds to apply. Recorded Future does not discriminate based on race, religion, color, national origin, gender including pregnancy, sexual orientation, gender identity, age, marital status, veteran status, disability or any other characteristic protected by law.
Recorded Future will not discharge, discipline or in any other manner discriminate against any employee or applicant for employment because such employee or applicant has inquired about, discussed, or disclosed the compensation of the employee or applicant or another employee or applicant.
Recorded Future does not administer a lie detector test as a condition of employment or continued employment. This is in compliance with the law of the Commonwealth of Massachusetts, and in alignment with our hiring practices across all jurisdictions.
Recorded Future maintains a drug-free workplace.
Note: Our interview process for all final-round candidates requires a mandatory in-person interview or a live, scheduled video conference with the hiring manager. We do not conduct interviews via instant messaging or text. All communications during the application process will come from individuals within our HR department via their Recorded Future email address.
Notice to Agency and Search Firm Representatives: Recorded Future will not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to Recorded Future, including those sent to our employees or through our website, will become the property of Recorded Future. Recorded Future will not be liable for any fees related to unsolicited resumes.
Agencies must have a valid written agreement in place with Recorded Future's recruitment team and must receive written authorization before submitting resumes. Submissions made without such agreements and authorization will not be accepted and no fees will be paid.
Source: Recorded Future careers · View original posting
About Recorded Future
Security at Recorded Future
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
Security Philosophy
- Section 1 — Philosophy and priorities.
- Dedicated product security mission — "Recorded Future has a dedicated product security team that scours our service for potential vulnerabilities, and helps our engineers ship secure code." (Recorded Future Security FAQ) Risk prioritization — "track and prioritize vulnerabilities that may impact our technical infrastructure" using the Vulnerability Intelligence Module. (Recorded Future Security FAQ) Defense-in-depth — Recorded Future describes layered controls including SAST, DAST, external vulnerability scanning, configuration management, a web application firewall, bug bounty, and penetration testing. (Recorded Future Security FAQ) Stated pain points or goals — The public goal is to help engineers ship secure code and identify vulnerabilities affecting the platform and infrastructure. (Recorded Future Security FAQ).
Security Team
- Section 2 — People and structure.
- Org model — A dedicated product security team is publicly identified, but whether it is centralized or embedded is not stated. (Recorded Future Security FAQ) Publicly identified security leaders — No clearly identified AppSec leader was found in the reviewed results.
- Jan Johansson is listed as Senior Security Engineer at Recorded Future.
- LinkedIn: https://www.linkedin.com/in/jan-johansson-0a65aa7 (LinkedIn, updated) Adjacent security personnel — Kevin Sweetman is listed as Senior Security Engineer, Identity & Access Management.
- LinkedIn: https://www.linkedin.com/in/kevin-sweetman-05211595 (LinkedIn, updated) Team size estimate — Not determinable from public results.
- Search query used: "Recorded Future application security team LinkedIn".
- Result range: one dedicated product security team is stated, but no headcount is provided. (Recorded Future Security FAQ) Active AppSec job posting count — Not determinable from the reviewed results.
- The careers page provides a general openings portal without AppSec-specific postings in the returned content. (Recorded Future Careers) Engineering context — Recorded Future publicly describes R&D groups including Applications, Platform, Operations, QA, and Design, but does not explicitly place product security within that structure. (Recorded Future LinkedIn Culture page).
Key Initiatives
- Section 3 — Programs and workflows.
- Security Champions program Not found — No public Security Champions program was identified in the reviewed results.
- Shift-left in CI/CD Publicly stated controls include static application security testing and dynamic application security testing, but pre-commit hooks, IDE plugins, pipeline gates, and CI/CD integration details are not disclosed. (Recorded Future Security FAQ) Vulnerability management Intake sources — Recorded Future states that vulnerabilities may be identified through SAST, DAST, external vulnerability scanning, bug bounty reports, and penetration testing. (Recorded Future Security FAQ) Prioritization — The company says it uses its Vulnerability Intelligence Module to track and prioritize vulnerabilities affecting technical infrastructure. (Recorded Future Security FAQ) Secure SDLC ceremonies Recorded Future states that its software development life cycle is certified to ISO 27001, ISO 9001, and NIST 800-200, and that product security helps engineers ship secure code.
- Specific threat-modeling, design-review, or security-signoff ceremonies are not disclosed. (Recorded Future Security FAQ) New programs or tool rollouts in the last 6 months No publicly documented AppSec program or tool rollout was identified in the reviewed results.
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
Interested in this role?
Apply on Recorded Future's site