Invest in your career with a Madrona-funded company.

DevSecOps Engineer

Remote - based in Spain, South Africa or the UK on CET/CAT

TROOP is a group meeting planning and travel management platform that helps companies bring teams together for in-person meetings. The experience starts with TROOP’s award-winning Intelligent Destination Recommendations, which use advanced algorithms to help meeting planners pinpoint the perfect meeting destination, considering travel time, climate impact, budget, lodging availability, and safety factors for all attendees.

Using TROOP, companies have saved millions in travel costs, employee time, and carbon emissions, making it possible for people to meet and build stronger relationships with their colleagues, clients, and partners, even in times of tightening budgets and travel restrictions.

Why TROOP?

TROOP believes in the power of shared experiences and the unifying impact of in-person meetings. We are on a mission to bring people together by transforming the meeting planning process.

At TROOP, we have ambitious goals to be the leading provider of end-to-end meeting planning tools. We started by inventing a completely new way for people to decide where to meet, but for us, the destination is just the beginning. We’re developing more innovative solutions that make it easier than ever to organize and host successful group meeting experiences.

TROOP's Culture?

TROOP is an international, remote-first company. Our colleagues are spread across the globe, with entities in Spain, South Africa, the UK, and the United States. Our culture is rooted in an African philosophy called "Ubuntu," which means "I am because we are." It refers to an environment of interdependence through trust. We call ourselves TROOPers, and we are people who seek adventure, challenge the status quo, enjoy innovating, and want to be part of something special. We are doers who roll up our sleeves and get into the details; we own the problem and only stop once it is solved.

TROOP is hiring for a DevSecOps Engineer who combines technical expertise with a deep understanding of security and compliance frameworks. In this role, you will be a critical link between our technical teams, clients, and stakeholders, driving security best practices within the development lifecycle and ensuring our compliance with industry and regulatory standards.

What you’ll be doing:

• Client Interaction & Collaboration
• Engage with clients to understand their security requirements, compliance needs, and privacy expectations.
• Act as a trusted advisor to clients on DevSecOps best practices, security architecture, and compliance strategies.
• Facilitate security and compliance discussions with internal teams, clients, and stakeholders to ensure alignment with security goals and objectives.
• Compliance Management
• Lead the implementation and management of compliance frameworks.
• Develop and maintain Policy-as-Code to enforce compliance policies within the CI/CD pipeline, ensuring security controls are applied consistently across environments.
• Conduct regular compliance audits, vulnerability assessments, and risk analyses to identify and mitigate potential compliance issues.
• Establish, document, and maintain security policies, including a Written Information Security Program (WISP).
• Bounty Program Oversight
• Manage bug bounty programs, serving as the primary point of contact for vulnerability submissions and ethical hacker interactions.
• Triage and prioritize reported vulnerabilities, coordinating with development and security teams for swift remediation.
• Implement feedback loops to integrate insights from bug bounty reports into our security practices, minimizing recurring vulnerabilities.
• GDPR and Privacy Requirements
• Implement and maintain data protection practices in line with GDPR and other privacy regulations, focusing on areas such as data encryption, access control, and data minimization.
• Automate processes to handle data subject rights requests, such as data erasure and portability, in compliance with GDPR requirements.
• Conduct Privacy Impact Assessments (PIAs) and ensure privacy-by-design principles are integrated into the development lifecycle.
• Security Automation and Infrastructure
• Develop and implement automated security testing within CI/CD pipelines, including static analysis, dynamic analysis, and dependency scanning.
• Integrate security tools to automate vulnerability detection, access control, configuration management, and compliance monitoring.
• Continuously improve security policies, processes, and tools, adapting to new threats and changing regulatory requirements.
• Legal and Regulatory Liaison
• Collaborate with legal and compliance teams to interpret new regulations and understand their impact on the business and product development.
• Maintain up-to-date knowledge of relevant legal and regulatory requirements and proactively drive necessary changes in DevSecOps practices.
• Serve as a security and compliance resource for legal inquiries, audits, and regulatory reporting.