Conduct threat modeling and security design reviews for new features, services, and architectural changes—partnering with product and platform engineers early in the design phase. Perform secure code reviews and provide actionable feedback, focusing on authentication, authorization, input handling, secrets management, and data protection. Deploy and maintain security tooling across the development lifecycle—SAST, SCA, DAST, secret scanning, IaC scanning, and CI/CD security guardrails. Support best practices to adopt secure-by-default libraries, frameworks, paved-road patterns, and developer guidance to reduce classes of vulnerabilities across the codebase. Partner with platform engineering on infrastructure and environment security—including AWS resource hardening, Terraform-managed infrastructure reviews, network segmentation, and environment isolation improvements. Contribute to incident response for security events: investigation, root cause analysis, and post-incident hardening. Drive vulnerability triage and prioritization across teams, tracking remediation against targets and reporting metrics. Partner with sales and legal responding to customer and vendor questionnaires, RFP security sections, and trust-and-safety inquiries. Support SOC 2, ISO 27001, PCI 4.0, and other compliance audit cycles by gathering evidence, documenting controls, and coordinating with auditors. Monitor and respond to alerts from endpoint, cloud, and application security tools; manage vulnerability tracking and remediation follow-up across the environment. Execute recurring user access reviews, IAM hygiene tasks, and RBAC maintenance required by compliance frameworks. Maintain and improve security runbooks, process documentation, and operational playbooks—building automation where possible to reduce manual burden using AI-assisted development tools.