Description
At Gong, you will join a company built on innovative products, ambitious goals, and passionate people.
Gong's Cloud Engineering group is the infrastructure backbone of a platform that processes millions of customer interactions every day.
We're looking for a DevSecOps Manager to lead our Israel-based DevSecOps team and own the security posture of Gong's cloud infrastructure.
You'll own:
- The security posture of Gong's multi-cloud infrastructure across AWS, Azure, and GCP.
- Identity governance, least-privilege access, credential lifecycle management, and cloud vulnerability management.
- Security controls embedded directly into the cloud platform, enabling R&D teams to build and operate securely by default.
- Developer toolchain security, including CI/CD pipelines, software supply chain risks, and developer-facing guardrails.
- The implementation of security as code, replacing manual processes and ticket-based controls with scalable automation.
- The leadership, development, and technical growth of a team of DevOps and DevSecOps engineers.
- Team's roadmap, priorities, and quarterly planning in alignment with Cloud Engineering and the broader Security organization.
- The team's role as the primary cloud security partner for Product Security, R&D, and Cloud Engineering.
- Clear security standards, ownership boundaries, and operating practices across the cloud platform.
You'll solve:
- Security challenges across a large, evolving environment with multiple production cells, several cloud providers, and more than 500 engineers.
- Gaps in cloud identity, permissions, credentials, workload protection, and vulnerability management.
- Security risks within Kubernetes, including RBAC, pod security, network policies, and runtime protection.
- Risks across GitHub, CI/CD pipelines, third-party dependencies, and the software supply chain.
- Friction between strong security controls and the speed, usability, and autonomy R&D teams need.
- Repetitive security work by turning manual controls into automated, reusable platform capabilities.
- Cross-functional challenges that require alignment between Cloud Engineering, Product Security, R&D, and compliance stakeholders.
- Emerging cloud security gaps by proactively identifying them, proposing practical solutions, and driving remediation through completion.
You'll impact:
- Gong's ability to operate a secure, resilient, and scalable multi-cloud platform.
- The security of the infrastructure supporting millions of customer interactions each day.
- Engineering velocity by providing secure-by-default capabilities and self-service guardrails.
- The effectiveness and consistency of cloud security controls across production environments.
- The maturity of Gong's DevSecOps practices, automation, and security-as-code capabilities.
- The technical development of a strong team and its evolution into a center of cloud security expertise.
- Strategic decisions across Cloud Engineering through active participation in the Cloud Engineering management forum.
- How more than 500 engineers build, deploy, and operate secure applicative services at scale.
You are:
- An experienced engineering manager with at least two years of experience leading a DevSecOps, DevOps, platform, or cloud security team.
- A hands-on technical leader with at least 7 years of experience in DevOps and cloud security who can build and troubleshoot solutions - not only review them.
- Deeply experienced with AWS security services and controls (including IAM, SCPs, GuardDuty, CloudTrail, and KMS), and across Azure and GCP as well.
- Strong in Kubernetes security, including RBAC, pod security, network policies, and runtime tooling.
- Experienced in securing GitHub organizations and CI/CD pipelines built with technologies such as GitHub Actions and Jenkins.
- Familiar with cloud security posture management platforms such as Wiz, Orca Security, or Prisma Cloud.
- Fluent in infrastructure as code using Terraform, Crossplane, or equivalent technologies.
- Comfortable balancing security, developer experience, operational needs, and business priorities, Proactive and accountable, with a track record of identifying gaps and driving solutions through completion.
An advantage:
- Security certifications such as CKS, CISSP, or CISM.
- Experience with GitOps practices and tools such as Argo CD or Argo Workflows.