Senior Security Engineer

We need to output HTML fragment with sections: About the role? The posting includes mission description, security team description, "What You Will Do", "Who You Are", "Minimum Qualifications", "Nice To Have", "Compensation", "Perks That You Need To Know About", plus some cultural statements. We need to decide which sections to include based on content. We must not repeat job title as heading. No Job ID. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions. At end there is "Notice for California Applicants Los Angeles County Fair Chance Notice" - that's legal boilerplate, should be removed. Also "As an equal opportunity employer..." is EEO boilerplate, remove. Also "Do your best work, be your authentic self..." maybe cultural but could be kept? It's not a standard section heading; but we could include as part of About the role? Might be considered fluff but it's substantive? It's about culture; we could include under "About the role" or maybe a separate "Culture" but not required. The instruction: Prefer a few substantive sections over many thin ones. So we can combine. We need headings:

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Use those exact headings? It says e.g., so we can use those headings if appropriate. We have sections: About the role (mission, team description). Responsibilities (What You Will Do). Requirements/Qualifications (Minimum Qualifications). Skills (maybe Nice To Have? Or we could put Skills under Requirements). Benefits (Perks). Pay (Compensation). Schedule not present, so omit. We must not create sections with filler like "commensurate with experience". Compensation section: we have base pay range and bonuses etc. That's substantive. So include Pay. Benefits: we have perks list. Include Benefits. Schedule: not present, omit. We need to ensure we don't include headings with empty content. We need to use

• for any list of duties/requirements/benefits. So for responsibilities list, we need
  • . For qualifications list, also
    • . For benefits list, also
      • . For skills maybe also list. We need to preserve all substantive information; do not invent or summarize away detail. So we need to keep the exact details? We can paraphrase but must preserve meaning. Safer to keep sentences as is, maybe break into list items. Let's extract content. About the role: first paragraph: "At Compass, our mission is to help everyone find their place in the world. Founded in 2012, we’re revolutionizing the real estate industry with our end-to-end platform that empowers residential real estate agents to deliver exceptional service to seller and buyer clients. Security @ Compass We are hands-on security engineers helping to build secure, resilient, and scalable web apps, mobile apps, and platform for the real estate industry. We work with a diverse set of teams to provide and support transparent and automated security tooling and services. We architect secure web products, perform simulated attacks, identify weaknesses, and work with teams to remediate and protect our products. You will lead our effort to build security as a service to drive safe-by-default environments and drive customer trust." We can keep that as prose under About the role. Responsibilities (What You Will Do): list: - Empower engineers with safe-by-default tooling, ensuring engineering velocity by automating security requirements and building robust guardrails. - Design and implement scalable systems and controls to secure our cloud infrastructure effectively. - Collaborate closely with engineering and security teams to drive the deployment of critical security enhancements and control changes across our cloud infrastructure. - Build enduring, high-trust partnerships with colleagues across the Engineering organization. - Assist in investigating and responding to security events, then work with teams to guide and improve their security practices. - Conduct security assessments for third-party integrations and emerging AI tools, ensuring that business productivity does not compromise data integrity or compliance. We'll put each as
      • . Who You Are: list of attributes: - Automation is your default approach to security. You understand the unique challenges of securing systems at scale and consistently leverage automation to solve them. - You possess a proactive mindset, adept at identifying and resolving security gaps or inefficiencies through innovative automation and tooling. - Expertise in securing cloud platforms, particularly AWS and Azure. - Strong analytical and problem-solving skills, with the ability to critically and objectively assess complex security risks. - Excited to collaborate with cross-functional teams to build secure, reliable, and scalable systems. - You can clearly communicate complex security vulnerabilities and remediation techniques to diverse audiences. - You are comfortable guiding and educating development teams to achieve stronger security outcomes. - Experience with threat modeling and architectural review processes; you have a track record of identifying potential attack vectors early in the development lifecycle. We could put under Skills or Requirements. The instruction says use headings like Skills, Requirements, Qualifications. We have Minimum Qualifications and Nice To Have. We could treat Minimum Qualifications as Requirements/Qualifications. Nice To Have as Skills? Or we could combine. Better: Use "Requirements" for Minimum Qualifications, and "Skills" for Nice To Have (or maybe "Qualifications" for Minimum). But we need to avoid thin sections. We have both Minimum and Nice; we could combine into one "Requirements" section with sublists? But instruction: prefer few substantive sections over many thin ones. Having both Requirements and Skills may be thin if each only few items. However we have many items in each. Could be okay. We'll create:

        Requirements

        with
        of Minimum Qualifications.

        Skills

        with
        of Nice To Have. But we also have "Who You Are" which is more about attributes; could be part of Skills or Requirements. Might be better to treat "Who You Are" as Skills (behavioral). However we already have Skills for Nice To Have (technical). Might be overlapping. Alternative: Use "Qualifications" for Minimum Qualifications, "Skills" for Nice To Have, and embed "Who You Are" into either Qualifications or Skills as part of list. But we must not lose info. Maybe we create a section "Qualifications" for Minimum Qualifications, and another section "Preferred Qualifications" for Nice To Have. But headings list includes Qualifications, Skills. We could use "Qualifications" for Minimum, and "Skills" for Nice To Have. Then where to put "Who You Are"? Could be part of Skills as well (soft skills). We'll merge Who You Are items into Skills list along with Nice To Have. Thus Skills section will contain both behavioral and nice-to-have technical. Let's list Skills items: From Who You Are: - Automation is your default approach to security. You understand the unique challenges of securing systems at scale and consistently leverage automation to solve them. - You possess a proactive mindset, adept at identifying and resolving security gaps or inefficiencies through innovative automation and tooling. - Expertise in securing cloud platforms, particularly AWS and Azure. - Strong analytical and problem-solving skills, with the ability to critically and objectively assess complex security risks. - Excited to collaborate with cross-functional teams to build secure, reliable, and scalable systems. - You can clearly communicate complex security vulnerabilities and remediation techniques to diverse audiences. - You are comfortable guiding and educating development teams to achieve stronger security outcomes. - Experience with threat modeling and architectural review processes; you have a track record of identifying potential attack vectors early in the development lifecycle. From Nice To Have: - Experience with GCP, OCI and multi-cloud networks and infrastructure, especially when designing cloud-agnostic systems. We'll include that as a skill. Now Requirements (Minimum Qualifications) list: - Experience: At least 5+ years of experience in a security-related role, with at least 2+ years specifically focused on cloud security. - Technical Skills: - Strong understanding of cloud platforms and security features, particularly AWS (IAM, EC2, VPC, container services like ECR, ECS, and EKS), with foundational knowledge of Azure and/or GCP - Strong understanding of Azure services and how to secure them. - Proven experience with a CNAPP or similar cloud security tool (e.g., Wiz, Orca Security, Lacework, Upwind). - Proficiency in at least one programming language (e.g., Python, Go) for automation. - Knowledge of core security principles such as the principle of least privilege, defense-in-depth, and security monitoring. - Familiarity with containerization technologies (Docker) and orchestration platforms (Kubernetes). We need to preserve the bullet structure. The original had "Experience:" then bullet, then "Technical Skills:" then sub-bullets. We'll flatten into list items, maybe keep sub-bullets as separate items. We'll produce
        • for each. Now Benefits (Perks That You Need To Know About) list: - Participation in our incentive programs (which may include eligible cash, equity, or commissions). - Plus paid vacation, holidays, sick time, parental leave, and recharge leave. - Medical, tele-health, dental and vision benefits. - 401(k) plan. - Flexible spending accounts (FSAs). - Commuter program. - Life and disability insurance. - Maven (a support system for new parents). - Carrot (fertility benefits). - UrbanSitter (caregiver referral network). - Employee Assistance Program. - Pet insurance. We'll keep as list. Pay (Compensation) section: we have paragraph: "The base pay range for this position is $153,000 - $171,000; however, base pay offered may vary depending on job-related knowledge, skills, and experience. Bonuses and restricted stock units may be provided as part of the compensation package, in addition to a full range of benefits. Base pay is based on market location. Minimum wage for the position will always be met." We'll put as

          under Pay heading. We should not include Schedule. Now About the role: we have prose; we can put as

          maybe multiple paragraphs. We'll keep as

          . Now ensure we don't include any boilerplate: remove "As an equal opportunity employer..." and "Notice for California Applicants Los Angeles County Fair Chance Notice". Also remove "Do your best work, be your authentic self..." maybe it's not boilerplate but it's cultural fluff; but we could keep as part of About the role? It's after the perks. It's basically a statement about culture; could be considered substantive but not required. The instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. That statement is not EEO; it's about culture. Might be okay to keep. But we already have About the role covering mission; adding that may be redundant. Safer to omit? It's not boilerplate but it's not essential. However we must preserve ALL substantive information; does that statement count as substantive? It's about culture and values; could be considered substantive. But we already have mission statement; still it's extra. I'd keep it maybe as part of About the role as an additional paragraph. But we need to avoid duplication; it's not duplicated elsewhere. I'll include it as a separate paragraph under About the role. Now produce HTML fragment. Structure:

          About the role

          ...

          Do your best work, be your authentic self....

          Responsibilities

          • ...
          ...

          Requirements

          • Experience: At least 5+ years of experience in a security-related role, with at least 2+ years specifically focused on cloud security.
          • Strong understanding of cloud platforms and security features, particularly AWS (IAM, EC2, VPC, container services like ECR, ECS, and EKS), with foundational knowledge of Azure and/or GCP