Note: The job is a remote job and is open to candidates in USA. atVenu is a revenue-positive company that has successfully navigated the startup landscape and is now focused on enhancing its application security. The Staff Developer / Development Manager will lead the application security program, manage a team of developers, and ensure compliance with PCI, GDPR, and SOC2 while balancing security needs with business objectives.

Responsibilities

• Define the roadmap, own application security risks, and make the case to engineering and executive leadership for what gets resourced and when
• Hire, develop, and retain application security developers
• Set technical direction, run code and architecture reviews, unblock your team, and build a security culture that scales across a fast-moving engineering organization without becoming a bottleneck
• Maintain and reduce cardholder data environment (CDE) scope across our Rails API, GraphQL layer, PostgreSQL, and mobile POS app
• Own the SOC2 and PCI DSS controls within our software development lifecycle
• Direct the audit and hardening of encryption, key management, and CouchDB sync pipeline
• Ensure GraphQL API changes are reviewed for injection risks, IDOR vulnerabilities, and over-exposed tenant data before they reach 500+ venues
• Own the SAST/DAST integration in our GitHub CI pipeline and set the bar for what ships
• Lead risk-ranked remediation across our Rails/Redis/PostgreSQL/CouchDB stack
• Your team needs a clear, fast process for deciding what gets patched and when
• Embed threat modelling into product development for new features
• Lead forensics, remediation, and post-mortems in collaboration with Engineering and Compliance

Skills

• 8+ years of development experience with at least 3 years in security-focused roles or responsibilities, plus demonstrated people management experience
• Experience building or maturing an application security program — roadmap ownership, risk prioritization, and cross-functional alignment with Engineering, Compliance, and Product
• Strong Ruby on Rails and React/React Native skills — you write and review production code, not just run scanners, and you've earned the kind of technical credibility that makes engineers actually listen when you make a point. Devs want to learn from you!
• Proven ability to communicate security risk to both technical and non-technical audiences and get organizational buy-in without resorting to fear or alarmism
• Hands-on AWS security experience: IAM, VPC, secrets management, CloudTrail/GuardDuty
• Deep knowledge of OWASP Top 10 (web and mobile), API security patterns, and common authentication/authorization flaws
• Experience and interest with AI tooling; you know when to use it and when to go old school
• Experience in the payment, retail and e-commerce space
• Experience with PCI, GDPR and/or SOC2 compliance in a production SaaS environment; deep knowledge of compliance and privacy management across North America and Europe

Company Overview