Senior Security Engineer
Later · Boston, MA · 1 mo ago
On-siteEngineering$125k–$205k/yrFull-time
We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title as heading. Must not include Job ID etc. Must preserve all substantive info, remove boilerplate, navigation, legal, EEO, etc. Must not create sections with filler like "commensurate with experience". Must include Pay if posting states salary ranges. It does: For US: $125,000-205,000 USD; For Canada: $110,000-160,000 CAD. So we can include Pay section with that info. Benefits: The posting mentions "all permanent team members are eligible to participate in various benefits plans as part of their overall compensation package." That's vague but it's a statement about benefits. It's not specific details but it's a statement. The instruction: never create Benefits sections unless posting actually states them. It does state that there are benefits plans. So we can include Benefits section with that sentence. Schedule: No mention of schedule (remote, full-time etc). Not present, so omit Schedule.
We need sections: About the role (maybe from "About this position:" paragraph). Responsibilities (What you'll be doing). Requirements/Qualifications/Skills: The posting has "What you bring:" which includes experience, etc. Also "How you work:" includes traits. Could split into Requirements (experience), Qualifications (frameworks), Skills (technical). But we can combine if needed. However instruction: Prefer a few substantive sections over many thin ones. So we could have About the role, Responsibilities, Requirements (covering experience, qualifications, skills, how you work). Benefits, Pay.
We must not repeat job title as heading. Use for each section heading.
We need to use
for each section heading.
We need to use - for any list of duties/requirements/benefits. So for responsibilities we should list bullet points. For requirements we can list bullet points. For benefits maybe just a paragraph.
We must preserve all substantive information; do not invent or summarize away detail. So we need to include all points from the posting, but we can condense into bullet points while preserving meaning. Must not lose detail.
Let's extract content.
About this position: paragraph: "We're looking for a Senior Security Engineer to strengthen Later's company-wide security posture through hands-on engineering, thoughtful collaboration, and pragmatic standards. This role blends deep security expertise with strong software engineering skills, with a focus on application security, cloud and infrastructure security, secure development practices, vulnerability management, compliance enablement, and security improvements across our corporate systems and business operations. You'll partner closely with teams across Engineering, Infrastructure, Product, IT, Legal, People, Finance, and other business functions to embed security into Later's systems, tools, workflows, and operating practices. A core focus of this role is helping Later mature its security capabilities in support of SOC 2 and other compliance expectations through practical controls, automation, evidence-ready processes, and clear guidance that works across the company. This role is ideal for a senior security practitioner who thinks like a defender, builds like a software engineer, and leads through influence across both technical and non-technical teams."
That's About the role.
What you'll be doing: sections: Company-Wide Security Strategy & Compliance (with bullet points), Technical Execution (bullet points), Collaboration & Enablement (bullet points). We can combine all responsibilities into a single list or keep subheadings? The instruction: use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid subheadings inside sections, but we should output only those headings. Could we include subheadings as ? Not specified; better to avoid extra headings. We can just make a flat list under Responsibilities with all duty items.
We need to preserve all substantive info; we can break into bullet points for each duty.
Let's list duties from the text:
Company-Wide Security Strategy & Compliance:
- Assess and continuously improve Later's overall security posture across applications, infrastructure, cloud environments, corporate systems, vendor tooling, and business workflows.
- Define and implement scalable security standards, best practices, and guardrails that support SOC 2 readiness through practical, automated, and auditable solutions.
- Partner with Engineering, Infrastructure, IT, Product, Legal, People, Finance, and business leaders to align security priorities with company goals, risk reduction, and delivery timelines.
- Translate SOC 2 and related compliance requirements into sustainable technical and operational controls, procedures, and evidence collection practices.
- Identify security gaps across the company, prioritize remediation efforts, and help teams make pragmatic, risk-based decisions.
- Support company-wide security awareness, secure operating practices, and adoption of security controls across business teams.
Technical Execution:
- Build and maintain internal security tools, automation, and services that support secure development, compliance workflows, vulnerability management, corporate security operations, and operational visibility.
- Design and implement security controls within CI/CD pipelines, including secure build and deploy patterns, security scanning, dependency management, container scanning, and secret management.
- Support application security efforts, including secure design reviews, threat modeling, code review guidance, API security, microservices security patterns, and remediation planning.
- Improve cloud infrastructure and corporate systems security through hardening, monitoring, configuration review, Infrastructure-as-Code security scanning, access reviews, and secure operational patterns.
- Collaborate with technical and business teams to identify vulnerabilities and control gaps, explain impact clearly, and drive effective remediation.
- Strengthen security observability and response readiness through logging, alerting, detection engineering, incident response improvements, and company-wide security process maturity.
Collaboration & Enablement:
- Partner with teams across the company to identify, understand, and fix security issues in a collaborative, non-blocking way.
- Provide pragmatic security guidance on designs, implementations, vendor tools, operational practices, and business workflows.
- Communicate security risks, tradeoffs, and recommendations clearly across technical and non-technical audiences.
- Embed security into development workflows, corporate systems, and company operating practices without slowing teams unnecessarily.
- Support SOC 2 and related compliance efforts through automation, well-defined controls, reliable evidence practices, and cross-functional coordination.
What success looks like: This is more about outcomes; could be considered part of responsibilities or maybe a separate section? Not listed as a standard heading; we could incorporate into Responsibilities as additional bullet points, but it's about success metrics. Might be considered part of responsibilities. We'll include as bullet points under Responsibilities.
Success metrics:
- Within the first 90 days, you've completed a security posture assessment, identified the highest-priority gaps, and have a remediation roadmap that's been reviewed and socialized with key stakeholders across Engineering, IT, and Leadership.
- By 6 months, core SOC 2 controls are documented, automated where possible, and evidence collection is running reliably without manual heroics from any single team.
- Security is embedded into Later's CI/CD pipelines, with scanning, secret management, and container security integrated and maintained as a standard part of the development lifecycle.
- Teams across Engineering, IT, and the business have a clear point of contact for security questions, a shared understanding of the risk landscape, and security guidance that helps them move faster, not slower.
- Later's security observability has materially improved: logging, alerting, and detection coverage are in place, and the company has a documented, practiced incident response process.
Now What you bring: list of qualifications/experience/skills.
We need to decide sections: Requirements, Qualifications, Skills. Could combine into one Requirements section with bullet points covering experience, knowledge, abilities. But we have also "How you work:" traits. Could be part of Requirements as well.
Let's extract bullet points from What you bring:
- 5-7+ years of experience as a Security Engineer or Software Engineer with a strong security focus.
- Proven ability to build and operate production-quality software, automation, and internal tooling.
- Strong understanding of application security, infrastructure security, cloud security, secure CI/CD practices, and corporate security controls.
- Hands-on experience with vulnerability management, secure software development, threat modeling, remediation workflows, and operational security improvements.
- Experience with security frameworks and standards such as OWASP, NIST, CIS Controls, SOC 2, and ISO 27001, and the ability to apply them in production and business environments.
- Experience supporting SOC 2 compliance efforts through practical, automated, and auditable controls.
- Familiarity with cloud security platforms such as AWS Security Hub, Azure Security Center, or GCP Security Command Center.
- Experience with SIEM/SOAR tools, logging and monitoring platforms, detection workflows, and practical incident response processes.
- Experience with Infrastructure-as-Code security scanning for tools such as Terraform or CloudFormation.
- Ability to translate complex security concepts into clear, actionable guidance for technical and non-technical audiences.
- Experience collaborating closely with engineering, IT, compliance, and business teams to improve security outcomes.
- Familiarity with C#, modern backend systems, cloud-native architecture, and SaaS business tooling.
How you work: traits (these are soft skills/behaviors):
- Driven by Impact: You deliver results that matter, prioritizing high-value work, meeting deadlines, and adapting quickly while keeping outcomes clear.
- Strategic & Customer-Centric: You anticipate risks and opportunities, connect decisions to long-term growth, and build trust through proactive insights.
- Curious & Growth-Oriented: You seek knowledge, ask sharp questions, and apply learnings fast, challenging the status quo with a mindset of improvement.
- Collaborative & Resilient: You thrive in change by staying resourceful, solution-focused, and positive, removing roadblocks, sharing insights, and keeping morale high.
- Accountable & Honest: You own your work, hold yourself and others to a high bar, and use transparent feedback to drive growth.
- Emotionally Intelligent: You build trust through empathy and collaboration, foster inclusion, and inspire others with grit, optimism, and integrity.
We could include these under Requirements or maybe a separate "Qualifications" for traits. But instruction: Prefer a few substantive sections over many thin ones. So we can have one Requirements section that includes both hard qualifications and soft skills.
Now Benefits: "Additionally, all permanent team members are eligible to participate in various benefits plans as part of their overall compensation package." That's the only benefits statement. We'll put that in Benefits section as a paragraph.
Pay: Provide the salary ranges.
Now we must not include boilerplate like Diversity, inclusion, etc. Remove that.
Now output HTML fragment.
Structure:
About the role
...
Responsibilities
- ...
...
Requirements
- ...
...
Benefits
...
Pay
...
We must not include Schedule.
Check that we didn't repeat job title. Good.
Now ensure we preserve all substantive info. Let's verify we didn't miss any duty or requirement.
From About this position: we captured all.
From What you'll be doing: we captured all bullet points from three subsections and success metrics.
From What you bring: we captured all bullet points.
From How you work: we captured all.
From Our approach to compensation: we captured salary ranges and benefits statement.
We removed diversity/inclusion etc.
Now check for any repeated lines: we should avoid duplication. Ensure we didn't duplicate any bullet.
Now produce HTML.
We need to be careful with HTML escaping: no special characters that need escaping besides maybe & but we can keep as is.
Let's craft.
About the role paragraph: combine the two sentences? Actually it's a few sentences. We'll put as We're looking for a Senior Security Engineer to strengthen Later's company-wide security posture through hands-on engineering, thoughtful collaboration, and pragmatic standards. This role blends deep security expertise with strong software engineering skills, with a focus on application security, cloud and infrastructure security, secure development
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid subheadings inside sections, but we should output only those headings. Could we include subheadings as ? Not specified; better to avoid extra headings. We can just make a flat list under Responsibilities with all duty items.
We need to preserve all substantive info; we can break into bullet points for each duty.
Let's list duties from the text:
Company-Wide Security Strategy & Compliance:
- Assess and continuously improve Later's overall security posture across applications, infrastructure, cloud environments, corporate systems, vendor tooling, and business workflows.
- Define and implement scalable security standards, best practices, and guardrails that support SOC 2 readiness through practical, automated, and auditable solutions.
- Partner with Engineering, Infrastructure, IT, Product, Legal, People, Finance, and business leaders to align security priorities with company goals, risk reduction, and delivery timelines.
- Translate SOC 2 and related compliance requirements into sustainable technical and operational controls, procedures, and evidence collection practices.
- Identify security gaps across the company, prioritize remediation efforts, and help teams make pragmatic, risk-based decisions.
- Support company-wide security awareness, secure operating practices, and adoption of security controls across business teams.
Technical Execution:
- Build and maintain internal security tools, automation, and services that support secure development, compliance workflows, vulnerability management, corporate security operations, and operational visibility.
- Design and implement security controls within CI/CD pipelines, including secure build and deploy patterns, security scanning, dependency management, container scanning, and secret management.
- Support application security efforts, including secure design reviews, threat modeling, code review guidance, API security, microservices security patterns, and remediation planning.
- Improve cloud infrastructure and corporate systems security through hardening, monitoring, configuration review, Infrastructure-as-Code security scanning, access reviews, and secure operational patterns.
- Collaborate with technical and business teams to identify vulnerabilities and control gaps, explain impact clearly, and drive effective remediation.
- Strengthen security observability and response readiness through logging, alerting, detection engineering, incident response improvements, and company-wide security process maturity.
Collaboration & Enablement:
- Partner with teams across the company to identify, understand, and fix security issues in a collaborative, non-blocking way.
- Provide pragmatic security guidance on designs, implementations, vendor tools, operational practices, and business workflows.
- Communicate security risks, tradeoffs, and recommendations clearly across technical and non-technical audiences.
- Embed security into development workflows, corporate systems, and company operating practices without slowing teams unnecessarily.
- Support SOC 2 and related compliance efforts through automation, well-defined controls, reliable evidence practices, and cross-functional coordination.
What success looks like: This is more about outcomes; could be considered part of responsibilities or maybe a separate section? Not listed as a standard heading; we could incorporate into Responsibilities as additional bullet points, but it's about success metrics. Might be considered part of responsibilities. We'll include as bullet points under Responsibilities.
Success metrics:
- Within the first 90 days, you've completed a security posture assessment, identified the highest-priority gaps, and have a remediation roadmap that's been reviewed and socialized with key stakeholders across Engineering, IT, and Leadership.
- By 6 months, core SOC 2 controls are documented, automated where possible, and evidence collection is running reliably without manual heroics from any single team.
- Security is embedded into Later's CI/CD pipelines, with scanning, secret management, and container security integrated and maintained as a standard part of the development lifecycle.
- Teams across Engineering, IT, and the business have a clear point of contact for security questions, a shared understanding of the risk landscape, and security guidance that helps them move faster, not slower.
- Later's security observability has materially improved: logging, alerting, and detection coverage are in place, and the company has a documented, practiced incident response process.
Now What you bring: list of qualifications/experience/skills.
We need to decide sections: Requirements, Qualifications, Skills. Could combine into one Requirements section with bullet points covering experience, knowledge, abilities. But we have also "How you work:" traits. Could be part of Requirements as well.
Let's extract bullet points from What you bring:
- 5-7+ years of experience as a Security Engineer or Software Engineer with a strong security focus.
- Proven ability to build and operate production-quality software, automation, and internal tooling.
- Strong understanding of application security, infrastructure security, cloud security, secure CI/CD practices, and corporate security controls.
- Hands-on experience with vulnerability management, secure software development, threat modeling, remediation workflows, and operational security improvements.
- Experience with security frameworks and standards such as OWASP, NIST, CIS Controls, SOC 2, and ISO 27001, and the ability to apply them in production and business environments.
- Experience supporting SOC 2 compliance efforts through practical, automated, and auditable controls.
- Familiarity with cloud security platforms such as AWS Security Hub, Azure Security Center, or GCP Security Command Center.
- Experience with SIEM/SOAR tools, logging and monitoring platforms, detection workflows, and practical incident response processes.
- Experience with Infrastructure-as-Code security scanning for tools such as Terraform or CloudFormation.
- Ability to translate complex security concepts into clear, actionable guidance for technical and non-technical audiences.
- Experience collaborating closely with engineering, IT, compliance, and business teams to improve security outcomes.
- Familiarity with C#, modern backend systems, cloud-native architecture, and SaaS business tooling.
How you work: traits (these are soft skills/behaviors):
- Driven by Impact: You deliver results that matter, prioritizing high-value work, meeting deadlines, and adapting quickly while keeping outcomes clear.
- Strategic & Customer-Centric: You anticipate risks and opportunities, connect decisions to long-term growth, and build trust through proactive insights.
- Curious & Growth-Oriented: You seek knowledge, ask sharp questions, and apply learnings fast, challenging the status quo with a mindset of improvement.
- Collaborative & Resilient: You thrive in change by staying resourceful, solution-focused, and positive, removing roadblocks, sharing insights, and keeping morale high.
- Accountable & Honest: You own your work, hold yourself and others to a high bar, and use transparent feedback to drive growth.
- Emotionally Intelligent: You build trust through empathy and collaboration, foster inclusion, and inspire others with grit, optimism, and integrity.
We could include these under Requirements or maybe a separate "Qualifications" for traits. But instruction: Prefer a few substantive sections over many thin ones. So we can have one Requirements section that includes both hard qualifications and soft skills.
Now Benefits: "Additionally, all permanent team members are eligible to participate in various benefits plans as part of their overall compensation package." That's the only benefits statement. We'll put that in Benefits section as a paragraph.
Pay: Provide the salary ranges.
Now we must not include boilerplate like Diversity, inclusion, etc. Remove that.
Now output HTML fragment.
Structure:
About the role
...
Responsibilities
- ...
...
Requirements
- ...
...
Benefits
...
Pay
...
We must not include Schedule.
Check that we didn't repeat job title. Good.
Now ensure we preserve all substantive info. Let's verify we didn't miss any duty or requirement.
From About this position: we captured all.
From What you'll be doing: we captured all bullet points from three subsections and success metrics.
From What you bring: we captured all bullet points.
From How you work: we captured all.
From Our approach to compensation: we captured salary ranges and benefits statement.
We removed diversity/inclusion etc.
Now check for any repeated lines: we should avoid duplication. Ensure we didn't duplicate any bullet.
Now produce HTML.
We need to be careful with HTML escaping: no special characters that need escaping besides maybe & but we can keep as is.
Let's craft.
About the role paragraph: combine the two sentences? Actually it's a few sentences. We'll put as We're looking for a Senior Security Engineer to strengthen Later's company-wide security posture through hands-on engineering, thoughtful collaboration, and pragmatic standards. This role blends deep security expertise with strong software engineering skills, with a focus on application security, cloud and infrastructure security, secure development
- with all duty items.
We need to preserve all substantive info; we can break into bullet points for each duty.
Let's list duties from the text:
Company-Wide Security Strategy & Compliance:
- Assess and continuously improve Later's overall security posture across applications, infrastructure, cloud environments, corporate systems, vendor tooling, and business workflows.
- Define and implement scalable security standards, best practices, and guardrails that support SOC 2 readiness through practical, automated, and auditable solutions.
- Partner with Engineering, Infrastructure, IT, Product, Legal, People, Finance, and business leaders to align security priorities with company goals, risk reduction, and delivery timelines.
- Translate SOC 2 and related compliance requirements into sustainable technical and operational controls, procedures, and evidence collection practices.
- Identify security gaps across the company, prioritize remediation efforts, and help teams make pragmatic, risk-based decisions.
- Support company-wide security awareness, secure operating practices, and adoption of security controls across business teams.
Technical Execution:
- Build and maintain internal security tools, automation, and services that support secure development, compliance workflows, vulnerability management, corporate security operations, and operational visibility.
- Design and implement security controls within CI/CD pipelines, including secure build and deploy patterns, security scanning, dependency management, container scanning, and secret management.
- Support application security efforts, including secure design reviews, threat modeling, code review guidance, API security, microservices security patterns, and remediation planning.
- Improve cloud infrastructure and corporate systems security through hardening, monitoring, configuration review, Infrastructure-as-Code security scanning, access reviews, and secure operational patterns.
- Collaborate with technical and business teams to identify vulnerabilities and control gaps, explain impact clearly, and drive effective remediation.
- Strengthen security observability and response readiness through logging, alerting, detection engineering, incident response improvements, and company-wide security process maturity.
Collaboration & Enablement:
- Partner with teams across the company to identify, understand, and fix security issues in a collaborative, non-blocking way.
- Provide pragmatic security guidance on designs, implementations, vendor tools, operational practices, and business workflows.
- Communicate security risks, tradeoffs, and recommendations clearly across technical and non-technical audiences.
- Embed security into development workflows, corporate systems, and company operating practices without slowing teams unnecessarily.
- Support SOC 2 and related compliance efforts through automation, well-defined controls, reliable evidence practices, and cross-functional coordination.
What success looks like: This is more about outcomes; could be considered part of responsibilities or maybe a separate section? Not listed as a standard heading; we could incorporate into Responsibilities as additional bullet points, but it's about success metrics. Might be considered part of responsibilities. We'll include as bullet points under Responsibilities.
Success metrics:
- Within the first 90 days, you've completed a security posture assessment, identified the highest-priority gaps, and have a remediation roadmap that's been reviewed and socialized with key stakeholders across Engineering, IT, and Leadership.
- By 6 months, core SOC 2 controls are documented, automated where possible, and evidence collection is running reliably without manual heroics from any single team.
- Security is embedded into Later's CI/CD pipelines, with scanning, secret management, and container security integrated and maintained as a standard part of the development lifecycle.
- Teams across Engineering, IT, and the business have a clear point of contact for security questions, a shared understanding of the risk landscape, and security guidance that helps them move faster, not slower.
- Later's security observability has materially improved: logging, alerting, and detection coverage are in place, and the company has a documented, practiced incident response process.
Now What you bring: list of qualifications/experience/skills.
We need to decide sections: Requirements, Qualifications, Skills. Could combine into one Requirements section with bullet points covering experience, knowledge, abilities. But we have also "How you work:" traits. Could be part of Requirements as well.
Let's extract bullet points from What you bring:
- 5-7+ years of experience as a Security Engineer or Software Engineer with a strong security focus.
- Proven ability to build and operate production-quality software, automation, and internal tooling.
- Strong understanding of application security, infrastructure security, cloud security, secure CI/CD practices, and corporate security controls.
- Hands-on experience with vulnerability management, secure software development, threat modeling, remediation workflows, and operational security improvements.
- Experience with security frameworks and standards such as OWASP, NIST, CIS Controls, SOC 2, and ISO 27001, and the ability to apply them in production and business environments.
- Experience supporting SOC 2 compliance efforts through practical, automated, and auditable controls.
- Familiarity with cloud security platforms such as AWS Security Hub, Azure Security Center, or GCP Security Command Center.
- Experience with SIEM/SOAR tools, logging and monitoring platforms, detection workflows, and practical incident response processes.
- Experience with Infrastructure-as-Code security scanning for tools such as Terraform or CloudFormation.
- Ability to translate complex security concepts into clear, actionable guidance for technical and non-technical audiences.
- Experience collaborating closely with engineering, IT, compliance, and business teams to improve security outcomes.
- Familiarity with C#, modern backend systems, cloud-native architecture, and SaaS business tooling.
How you work: traits (these are soft skills/behaviors):
- Driven by Impact: You deliver results that matter, prioritizing high-value work, meeting deadlines, and adapting quickly while keeping outcomes clear.
- Strategic & Customer-Centric: You anticipate risks and opportunities, connect decisions to long-term growth, and build trust through proactive insights.
- Curious & Growth-Oriented: You seek knowledge, ask sharp questions, and apply learnings fast, challenging the status quo with a mindset of improvement.
- Collaborative & Resilient: You thrive in change by staying resourceful, solution-focused, and positive, removing roadblocks, sharing insights, and keeping morale high.
- Accountable & Honest: You own your work, hold yourself and others to a high bar, and use transparent feedback to drive growth.
- Emotionally Intelligent: You build trust through empathy and collaboration, foster inclusion, and inspire others with grit, optimism, and integrity.
We could include these under Requirements or maybe a separate "Qualifications" for traits. But instruction: Prefer a few substantive sections over many thin ones. So we can have one Requirements section that includes both hard qualifications and soft skills.
Now Benefits: "Additionally, all permanent team members are eligible to participate in various benefits plans as part of their overall compensation package." That's the only benefits statement. We'll put that in Benefits section as a paragraph.
Pay: Provide the salary ranges.
Now we must not include boilerplate like Diversity, inclusion, etc. Remove that.
Now output HTML fragment.
Structure:
- ... ...
- ... ...
About the role
...
Responsibilities
Requirements
Benefits
...
Pay
...
We must not include Schedule. Check that we didn't repeat job title. Good. Now ensure we preserve all substantive info. Let's verify we didn't miss any duty or requirement. From About this position: we captured all. From What you'll be doing: we captured all bullet points from three subsections and success metrics. From What you bring: we captured all bullet points. From How you work: we captured all. From Our approach to compensation: we captured salary ranges and benefits statement. We removed diversity/inclusion etc. Now check for any repeated lines: we should avoid duplication. Ensure we didn't duplicate any bullet. Now produce HTML. We need to be careful with HTML escaping: no special characters that need escaping besides maybe & but we can keep as is. Let's craft. About the role paragraph: combine the two sentences? Actually it's a few sentences. We'll put asWe're looking for a Senior Security Engineer to strengthen Later's company-wide security posture through hands-on engineering, thoughtful collaboration, and pragmatic standards. This role blends deep security expertise with strong software engineering skills, with a focus on application security, cloud and infrastructure security, secure development