Senior / Staff Security Engineer

Depending on your experience / skillset and our broader priorities, you could:

• Operate, automate, and extend vulnerability management end-to-end: triage, prioritize, and drive remediation across product, infrastructure, and dependencies, and keep the program’s SLAs meaningful rather than theoretical
• Run our bug bounty program: triage incoming reports, validate severity, work with engineering on fixes, and keep researcher relationships professional and responsive
• Lead product security testing: threat model new features (including AI/agent-facing surfaces), review designs and code for security-relevant risk, and do hands-on testing (manual and tool-assisted) rather than relying solely on scanners
• Be a primary responder for security incidents: lead investigation and containment, drive postmortems, and turn lessons into concrete hardening work
• Own meaningful chunks of our cloud/infra security posture on GCP/k8s/Postgres: harden configurations, close gaps surfaced by audits or scanning, and partner with infra engineering on secure defaults
• Build and maintain security tooling and automation, including using AI/LLM tooling to speed up triage, code review, and repetitive investigation work, so the program scales without linear headcount growth
• Partner with the GRC/Trust function: feed real findings into the risk register and control evidence, and help make sure compliance requirements reflect actual engineering practice

What we’re looking for:

• A generalist, senior-level security engineer (5+ years across security engineering, with real depth in at least two of: vulnerability management, product/appsec testing, incident response, and cloud security). We need breadth, rather than a narrow specialist in any one of these.
• Hands-on and technical: you can read and reason about code (we use a lot of TypeScript), you’re comfortable in cloud environments (GCP a plus), and you can go deep on a finding rather than just filing a ticket for someone else to fix. You’re comfortable using AI coding/security tools as force multipliers (Linear Agent, Claude, Codex, etc).
• Calm under pressure: you can lead an incident from first alert through postmortem without needing to be told what to do next.
• A builder: you’d rather write a script or ship a tool than repeat a manual process a third time.
• A pragmatic risk-reducer: you optimize for actually reducing risk, not for checking a box or maximizing findings count.
• Autonomy-oriented: comfortable setting your own priorities, working with significant independence, and knowing when to escalate.
• A clear communicator: able to explain a technical finding to a non-technical stakeholder and write it up so it’s actually actionable.

What we offer:

• Competitive salary and equity
• Employee-friendly equity terms including early exercise in the US and extended exercise windows
• Daily meal and coffee stipend on every workday
• Paid co-working space or desk
• Health coverage (based on country requirements)
• 5 weeks paid vacation, plus local statutory holidays
• 4 months paid parental leave
• Paid month off after 4 years & every 2 years thereafter
• Regular team events and off-sites
• Remote-first with no required commute