Senior / Staff Security Engineer

Accountabilities

• Own and continuously improve the vulnerability management lifecycle, including identifying, triaging, prioritizing, and remediating vulnerabilities across the product, infrastructure, and software dependencies.

• Maintain effective vulnerability remediation service-level agreements (SLAs), ensuring security findings translate into meaningful risk reduction.

• Manage the bug bounty program by reviewing incoming reports, validating severity, coordinating fixes with engineering teams, and maintaining professional relationships with security researchers.

• Lead product security assessments, including threat modeling new features, reviewing architecture and code, and conducting hands-on manual and tool-assisted testing.

• Evaluate emerging security risks associated with AI-powered features and agent-facing product capabilities.

• Serve as a primary incident responder, leading investigations, coordinating containment and recovery, facilitating post-incident reviews, and translating lessons learned into concrete security improvements.

• Strengthen cloud and infrastructure security across Google Cloud Platform (GCP), Kubernetes, PostgreSQL, and related services by hardening configurations and implementing secure defaults.

• Address security gaps identified through audits, automated scanning, and internal assessments in collaboration with infrastructure and engineering teams.

• Build and maintain security tooling, detections, scripts, and automation to improve operational efficiency and scale security processes.

• Leverage AI and large language model (LLM) tools to accelerate vulnerability triage, code review, and repetitive investigative tasks while maintaining appropriate technical oversight.

• Partner with Governance, Risk, and Compliance (GRC) and Trust teams to document risks, maintain risk registers, collect control evidence, and align compliance requirements with actual engineering practices.

• Communicate technical findings, risks, and remediation recommendations clearly to technical and non-technical stakeholders.

• Establish priorities independently, make pragmatic risk-based decisions, and escalate critical issues when necessary.

Requirements:

• At least five years of experience in security engineering, with substantial hands-on expertise in at least two of the following areas: vulnerability management, product or application security testing, incident response, and cloud security.

• Broad security engineering knowledge and the ability to work across multiple domains rather than focusing exclusively on a single specialization.

• Strong technical skills, including the ability to read, understand, and reason about application code, particularly TypeScript or comparable programming languages.

• Practical experience working in cloud environments; familiarity with Google Cloud Platform (GCP) is an advantage.

• Demonstrated ability to investigate security findings in depth, identify root causes, and work directly toward effective remediation rather than simply reporting issues.

• Experience with vulnerability assessment, threat modeling, security testing, incident investigation, or infrastructure hardening.

• Familiarity with AI-assisted coding and security tools, such as Claude, Codex, or comparable solutions, and the ability to use them responsibly to improve productivity.

• Strong incident management skills, including the ability to remain composed under pressure, lead investigations independently, and coordinate post-incident reviews.

• A builder mindset, with a preference for developing scripts, tools, detections, and automation to eliminate repetitive manual work.

• A pragmatic, risk-focused approach that prioritizes measurable security improvements over compliance checklists or raw finding counts.

• Strong ownership and prioritization skills, with the ability to work independently, navigate ambiguity, and recognize when escalation is necessary.

• Excellent written and verbal communication skills, including the ability to explain complex technical risks clearly and provide actionable recommendations.

• Ability to collaborate effectively with product, infrastructure, engineering, and compliance stakeholders in a distributed, remote-first environment.

• Familiarity with security and collaboration tools such as GitHub Advanced Security, RunReveal, SentinelOne, Vanta, GitHub, and Slack is beneficial.

Benefits:

• Competitive compensation: Salary and equity opportunities; a specific salary range for Canada was not provided.

• Equity benefits: Employee-friendly equity terms, including early exercise options in the United States and extended exercise windows.

• Remote-first work: Work remotely without a required daily commute.

• Flexible workspace: Paid coworking space or desk.

• Health coverage: Coverage provided according to applicable country requirements.

• Paid time off: Five weeks of paid vacation annually, in addition to local statutory holidays.

• Parental leave: Four months of paid parental leave.

• Extended time off: A paid month off after four years of service and every two years thereafter.

• Daily meal and coffee stipend for every workday.

• Team connection: Regular team events and off-sites.

• Work environment: A focused, collaborative team culture that values technical excellence, autonomy, and thoughtful execution.