Search jobs

Last checked Nov 3, 2026.

DevSecOps and secure delivery

• Embed security testing into CI/CD — static analysis, dependency and container scanning, secrets detection, Infrastructure as Code scanning, and dynamic testing — without creating unnecessary friction for developers.
• Define practical vulnerability-severity, remediation, exception, and escalation standards, and partner with developers to separate real risk from noise and fix root causes.
• Improve software supply-chain security, including build permissions, artifact integrity, dependency governance, and GitHub administration.

Detection, monitoring, and incident response

• Improve security visibility across cloud infrastructure, applications, identities, endpoints, and SaaS systems, and build alerts and detection logic that are worth acting on.
• Lead investigations and coordinate containment, remediation, and root-cause analysis, supported by clear runbooks, ownership, and escalation paths.
• Run tabletop exercises, and track and communicate security metrics and material risks to technical and business stakeholders.

Identity, governance, and enablement

• Strengthen SSO, MFA, privileged access, and onboarding, offboarding, and access-review processes across AWS, GitHub, Microsoft 365, Entra ID, production systems, and internal SaaS — automating provisioning, entitlement reviews, and evidence collection where practical.
• Translate security and compliance requirements into concrete technical controls, and support customer security reviews, audits, and programs such as SOC 2 and ISO 27001.
• Evaluate third-party tools and integrations for security, privacy, and access-control risk, and help select, consolidate, and rationalize Forma's security tooling for both coverage and cost.
• Maintain clear technical standards and provide practical guidance, training, and mentorship that raises security capability across Engineering.

What we're looking for

• Eight or more years of experience in security engineering, cloud security, application security, DevSecOps, or infrastructure engineering.
• Strong hands-on experience securing AWS environments, including IAM, networking, encryption, logging, and secrets management.
• Experience with Terraform, Kubernetes, containers, and security controls in CI/CD pipelines.
• Strong understanding of application and API security, authentication, authorization, and multi-tenant SaaS risks.
• Experience with vulnerability management, threat modelling, incident response, and security automation.
• Ability to write scripts using Python, Bash, PowerShell, or a similar language.
• Strong communication, troubleshooting, and cross-functional collaboration skills.

Strongly preferred

• Experience supporting SOC 2, ISO 27001, privacy programs, or enterprise customer security reviews.

Nice to have

• Experience securing analytics platforms, data pipelines, or systems handling sensitive customer data, including row-level, column-level, or attribute-based access controls.
• Experience with AWS security services, EKS, Datadog, Wiz, Snyk, CrowdStrike, or similar tools.
• Experience securing AI applications, large language models, agents, or Amazon Bedrock workloads.
• Experience in a B2B SaaS or high-growth technology company.
• Relevant security or cloud certifications.

Your first 30, 60, and 90 days

First 30 days: learn and assess

• Build an understanding of Forma's application architecture, AWS environments, deployment processes, data flows, identity systems, and security obligations.
• Meet key partners across Engineering, DevOps, IT, Product, Legal, and Privacy, and agree on how security reviews and escalations will operate.
• Review existing controls, open findings, incidents, access patterns, monitoring, and compliance commitments.
• Identify immediate risks, quick wins, and areas needing deeper assessment.

By 60 days: prioritize and improve

• Deliver a prioritized security roadmap based on risk, business impact, and engineering effort.
• Begin addressing the highest-priority gaps in cloud access, secrets management, CI/CD security, vulnerability management, and monitoring.
• Introduce or improve a consistent process for threat modelling and security architecture reviews, and define vulnerability-severity, ownership, remediation, and exception standards.
• Assess the current security tool stack for coverage, overlap, and cost, with consolidation recommendations.
• Improve incident-response runbooks, alert ownership, and escalation paths for critical systems, and recommend measurable security objectives and reporting metrics.

By 90 days: operationalize and lead

The expectation here is momentum, not completion — these should be underway and demonstrably working, not finished.

• A first set of automated security guardrails in place across AWS, Terraform, Kubernetes, GitHub, or CI/CD, with remaining coverage planned and underway.
• Repeatable processes running for vulnerability management, access reviews, security assessments, and incident follow-up, even if still being refined.
• Security reviews completed for the highest-priority product, data, or AI initiatives, with required controls agreed and in progress.
• Improved visibility into high-risk identities, infrastructure changes, and sensitive-data access.
• Progress, key risks, and the next phase of the security roadmap presented to leadership.

Additional Info

• This position is for an existing vacancy

What you can expect from us

Meaningful compensation. In addition to your base salary, you’ll join our employee stock ownership plan to further recognize your contributions to Forma.ai ’s success.

Healthcare coverage. We have a full benefits package that includes medical, dental, vision, disability and life insurance, and a paid parental leave program.

Learning and development. Access the resources you want to help you grow in your role by utilizing our $750 yearly training stipend.

Growth. You’ll have a huge opportunity to build a career for yourself and gain the type of experience you’re looking for, whether that’s as an individual contributor or as a people leader.

Our Values

• Work well, together. We’re real. We have kids and pets. Mortgages and student loans. We’re in this together, so no matter how brilliant any one of us is, we always play nice with one another – no exceptions.
• Be precise. Be relentless. We believe complacency breeds failure, so we set new goals as quickly as we achieve them. We persist in the face of adversity, learn from our mistakes, and push each other to continuously improve. The status-quo is kryptonite.
• Love our tech. Love our customers. Our platform solves a very complex problem in a currently underserved market. While everyone at Forma isn’t customer-facing, we’re all customer-focused. Maybe even slightly customer-obsessed. ­

Use of AI for Recruitment

Currently, Forma.ai does not use artificial intelligence as part of our recruitment process, specifically but not limited to the screening, filtering and shortlisting of applicants.

Our commitment to you

Forma is a proud equal opportunity employer that is committed to creating a diverse and inclusive work environment. Every effort to accommodate candidates for accessibility will be made upon request. Information received related to accommodations will be addressed confidentially. We know that applying to a new role takes a lot of effort. You're encouraged to apply even if your experience doesn't precisely match the job description. There are many paths to a successful career and we’re looking forward to reading yours.

We thank all candidates for their interest however only qualified applicants will be shortlisted.