Senior Application & Cloud Security EngineerEstablished in 2015, Create Music Group is a leading music and entertainment company. The company operates as a record label, distribution company, and entertainment network which generates over 15 billion music streams each month on DSP’s. Named #2 on the Inc 5000 Fastest Growth Companies in America in 2020, the company has grown exponentially by leveraging its owned IP with its media and technology platform. The company works with superstar artists, major and independent record labels, and global media brands. It operates a number of companies including Label Engine, one of the largest independent music distribution platforms in the world, with over 75,000 artists and 5,000 label clients; and Flighthouse, a digital entertainment brand focused on Gen Z, which has more than 300 million followers across social media. Create Music Group is based in Hollywood, CA and has 400 employees worldwide.Job SummaryThe Senior Application & Cloud Security Engineer will serve as the foundational security hire within the Technology organization, reporting to the VP of Data Engineering. This role will own and drive security across CMG's application portfolio and multi-cloud infrastructure (AWS + GCP). The role sits at the intersection of engineering and security—working hands‑on to harden Label Engine (PHP/Laravel on AWS, processing > $1B in royalties),secure the expanding GCP-based CreateOS data and AI platform, and operationalize the company's broader security roadmap covering identity management, endpoint protection, vulnerability management, incident response, and compliance.ResponsibilitiesLead application security for Label Engine (PHP 8.X / Laravel / MySQL / Redis / Elasticsearch) and web applications across the portfolioSecure royalty processing, accounting, and payment workflows handling sensitive financial dataImplement and manage SAST, DAST,



and SCA tooling integrated into CI/CD pipelinesConduct code-level security reviews (OWASP Top 10, Laravel-specific attack vectors)Define and enforce API security standards (OAuth 2.0, rate limiting, input validation)Secure and harden AWS infrastructure (EC2, RDS, S3, CloudFront, Lambda, IAM, VPC)Secure GCP environments for CreateOS (BigQuery, Pub/Sub, Cloud Run/GKE, IAM)Implement CSPM across AWS and GCP; enforce guardrails and compliance baselinesHarden container/Kubernetes security, secrets management, and network policiesSupport identity federation/SSO with Rippling as primary IDPBuild out security monitoring, SIEM, incident response, and vulnerability managementHelp operationalize CMG's security roadmap across all security domainsOther duties as assignedQualifications5+ years of experience in application security, cloud security, or security engineering roles.Bachelor's degree in Computer Science, Cybersecurity, or related field preferred (not required with equivalent experience)Solid PHP/Laravel application security expertiseDeep AWS security knowledge (IAM, VPC, S3, KMS, CloudTrail, GuardDuty, Security Hub, WAF)Solid GCP security experience (IAM, VPC Service Controls, Security Command Center, Cloud Armor)Proficiency with SAST/DAST/SCA tools (Semgrep, SonarQube, Snyk, Burp Suite, OWASP ZAP)Experience securing financial transaction / payment processing applicationsContainer security (Docker, Kubernetes/GKE), image scanning, runtime protectionStrong IAM understanding: SAML, OIDC, SCIM, MFA, privileged access managementFamiliarity with SOC 2, ISO 27001, NIST CSF, CIS BenchmarksSIEM/log management experience with detection and alerting rulesPreferred: PCI-DSS compliance, IaC security (Terraform), music/media industry experiencePreferred: AWS Security Specialty, GCSPE, OSCP, GWAPT, or CISSP certificationsPay Scale$120,000 - $135,000 CAD per yearThe final compensation within this range will be determined based on the candidate’s experience, skills, and overall fit for the role.#J-18808-Ljbffr

📌 Senior Application & Cloud Security Engineer - $120,000 - $135,000 A Year (Toronto)
🏢 Create Music Group
📍 Toronto