Software Engineer (Full-Stack & Cloud)

About GauntletGauntlet builds an agentless security platform for AWS, Azure and Google Cloud. Security and engineering teams use it for cloud security posture management, compliance, software supply chain security (SBOM), AI security posture management and secret scanning.

The roleWe're looking for a full-stack software engineer with 3+ years of experience to help build our cloud security platform. You'll work across the product, from the Python services that scan cloud accounts and the APIs behind them to the React dashboard our customers use every day.

You'll join a small engineering team where you'll own features from design to release and see their impact directly. Along the way, you'll deepen your experience in cloud infrastructure, DevOps and security.

What you'll do

• Build and maintain cloud security checks in Python for AWS, Azure and Google Cloud (boto3, the Azure SDK, Google Cloud client libraries), each with a clear severity, details and remediation.
• Keep scans fast and correct across many accounts: concurrent scanning, permission errors handled cleanly, results that are repeatable.
• Build REST APIs and services with FastAPI, backed by PostgreSQL through SQLAlchemy and Alembic migrations.
• Build dashboard features in React: data fetching and caching with SWR, filters, tables and charts, with MUI and Tailwind CSS.
• Write tests at every layer: pytest with mocked cloud APIs on the backend, Vitest on the frontend.
• Package services with Docker and run them on AWS (ECS, ECR, Lambda, S3, Cognito, Amplify Hosting).
• Own CI/CD in GitHub Actions: linting, security scans, tests, image builds and deployments from dev to production.
• Review pull requests, write clear docs and work with our security researchers on new detections.

What you bring

• Experience: 3+ years building and shipping production software, with work you can walk us through in detail.
• Python: clean, well-structured code with type hints, solid error handling, concurrency (threads or asyncio) and tests in pytest.
• JavaScript and TypeScript: modern ES features, async code, and TypeScript types for real API data.
• React: hooks, data fetching and caching, forms and tables, loading, error and empty states, and component tests.
• APIs and data: REST API design, SQL and a relational database, PostgreSQL preferred.
• Docker: production Dockerfiles (multi-stage, small, non-root) and Docker Compose for local stacks.
• CI/CD: you have built or maintained pipelines in GitHub Actions, GitLab CI or Jenkins that test, build and deploy.
• DevOps basics: Linux and the shell, logs and metrics, configuration and secrets handled safely.
• Cloud: hands-on with AWS, Azure or Google Cloud: you have deployed, configured IAM for and debugged a service there.
• Ways of working: Git with branches, pull requests and code review, and clear written English.

Nice to have

• Cloud security knowledge: CIS Benchmarks, IAM least privilege, network exposure, encryption, the OWASP Top 10.
• Experience with cloud security tools such as Prowler, ScoutSuite or Checkov, or with CSPM and CNAPP products.
• FastAPI, SQLAlchemy 2 and Alembic.
• Infrastructure as code: Terraform, AWS CloudFormation or CDK, or Bicep.
• AWS ECS and Fargate, Lambda, Cognito and Amplify, or their Azure and Google Cloud equivalents.
• Rust: two of our scanners are written in it.
• LLM APIs in production: we use them to write remediation steps and posture analytics.
• Software supply chain tooling: CycloneDX SBOMs, cdxgen, Syft or Grype.