Staff Security Engineer

Accountabilities: As a Staff Security Engineer, you will define technical security direction, lead risk reduction initiatives, and work alongside engineering teams to build secure and scalable systems. Your responsibilities will include: Partner with product managers and engineers from the earliest stages of development to conduct threat modeling, review architecture designs, and establish security requirements. Design and implement product security capabilities, including Single Sign-On (SSO), System for Cross-domain Identity Management (SCIM), granular access controls, audit logging, encryption, and key management. Identify systemic security risks across the engineering environment, prioritize remediation efforts, and lead long-term initiatives that eliminate entire categories of vulnerabilities. Develop and promote secure-by-default configurations, shared security libraries, reusable infrastructure components, and engineering guardrails. Establish security baselines for cloud and Kubernetes environments, covering RBAC, network policies, pod security standards, workload identity, secrets management, and admission controls. Define and implement security strategies for AI adoption and development, including threat modeling for AI-powered features and agentic workflows. Address AI-specific risks such as prompt injection, sensitive data exposure, and excessive agent permissions. Establish security guardrails for internal AI coding tools, autonomous agents, and Model Context Protocol (MCP) integrations. Evaluate new AI vendors and integrations in collaboration with engineering, IT, and legal stakeholders. Strengthen the secure software development lifecycle across design, code review, build, release, and deployment. Manage and improve GitHub organization security and CI/CD pipeline configurations, including access controls, branch protection, GitHub Actions permissions, secret scanning, dependency scanning, and software supply chain security. Define and implement a comprehensive secrets management strategy across applications, cloud infrastructure, CI/CD systems, and Kubernetes. Centralize secrets in managed storage solutions, replace long-lived credentials with short-lived identity-based access, establish rotation standards, and remediate exposed or hardcoded secrets. Build trusted relationships with engineering and product leaders, influence security decisions, and ensure security priorities are incorporated into team roadmaps. Provide technical leadership and mentorship to security engineers while improving security awareness and capabilities across engineering teams. Leverage AI tools to automate security workflows, improve design reviews, and scale security operations. Requirements The ideal candidate combines deep security engineering expertise with strong technical leadership and the ability to influence engineering decisions across an organization. You should have extensive experience securing complex software environments, implementing scalable security solutions, and translating technical risks into practical improvements. Key qualifications include: At least 10 years of experience in security engineering, software engineering, or infrastructure engineering, with substantial experience in product or infrastructure security. Proven track record of partnering with product and engineering teams to deliver security features and platform-level improvements. Deep understanding of the software development lifecycle, including design, code review, CI/CD, build, release, and deployment processes. Ability to read application code and pipeline configurations and identify security weaknesses. Hands-on experience securing GitHub organizations, including SSO, access management, branch protection, rulesets, CODEOWNERS, required reviews, and GitHub Actions security. Experience implementing least-privilege workflow permissions, OIDC integrations with cloud providers, third-party action pinning, secret scanning, push protection, and GitHub App and personal access token controls. Strong experience designing and implementing secrets management strategies using solutions such as HashiCorp Vault, Google Cloud Secret Manager, or AWS Secrets Manager. Knowledge of workload identity, short-lived credentials, automated secret rotation, and detection and response processes for exposed credentials. Extensive product and application security expertise, including threat modeling, secure design reviews, authentication and authorization vulnerabilities, and multi-tenant isolation. Experience designing and implementing security features such as SSO (SAML/OIDC), access controls, audit logging, and encryption. Strong infrastructure security experience with GCP or AWS, including IAM, network security, and Infrastructure as Code tools such as Terraform. Production experience securing Kubernetes environments, including cluster hardening, RBAC, network policies, admission controllers, and container image security. Experience securing AI and LLM-based systems or supporting organization-wide AI adoption. Understanding of AI security risks, including prompt injection, sensitive data exposure, and insecure agent tool usage. Familiarity with security guidance such as the OWASP Top 10 for LLM Applications. Demonstrated ability to lead cross-functional security remediation initiatives, from problem identification and stakeholder alignment through implementation. Strong communication and relationship-building skills, with the ability to influence senior engineers and leaders without direct authority. Ability to communicate complex security concepts through clear design documentation and actionable engineering guidance. Hands-on experience using AI tools such as Claude Code to automate and scale security work. Preferred Qualifications: Experience securing multi-tenant SaaS platforms or data analytics products. Knowledge of software supply chain security standards and tools, including SLSA, Sigstore, and Software Bill of Materials (SBOMs). Familiarity with service mesh technologies and zero-trust networking, including Istio and mutual TLS (mTLS). Experience implementing practical AI governance frameworks, including approved-tool policies, AI vendor assessments, and access controls for agents and MCP servers. Experience developing secure-by-default libraries, reusable security components, or standardized engineering platforms. Previous experience as a software engineer before transitioning into security, or equivalent experience working directly within engineering teams. Experience supporting SOC 2 or ISO 27001 security controls in engineering environments. Relevant professional certifications such as CKS, OSWE, OSCP, or equivalent. Benefits Total Target Cash Compensation: $230,000–$300,000 USD annually, including base salary and variable compensation. Additional equity compensation opportunities. Comprehensive medical, dental, and vision insurance. Mental wellness benefits. Generous vacation policy and additional company holidays. Enhanced parental leave. Volunteer time off. 401(k) retirement plan. Pre-tax benefits. Additional wellness benefits. Company-wide holiday breaks. Opportunities for professional growth and progression toward Principal Security Engineer. Collaborative environment built around innovation, transparency, customer focus, and cross-functional teamwork.