Staff Security Engineer

Role Overview

As a Staff Security Engineer, you'll get involved early with Product and Software Engineering teams to embed security into our architecture and processes as they design, build, and ship. You'll also be someone the Security team can pull into any project, at any phase and regardless of domain, to make sure it lands on the right security outcome. This is a hands-on role, and you don't need to be an expert in all three areas: application security, cloud security, and security automation and tooling. You should have strong, demonstrated depth in one of the three, along with enough working knowledge of the other two to contribute without hand-holding and to be a trusted voice on technical decisions outside the systems you personally own.

Responsibilities

• Partner with Engineering, DevOps, and Product across projects, providing security input at any phase of design or build, regardless of domain.
• Guide secure design and code review for web and mobile applications, and help manage core AppSec tooling (SAST, SCA, secret scanning, DAST, ASM, and mobile security tooling).
• Help triage and remediate application-level vulnerabilities with engineering teams.
• Contribute to cloud security posture across the AWS environment, including IAM, network segmentation, container security, secrets, and data exposure, using CNAPP and AWS-native tooling.
• Support cloud and application vulnerability management, and help tune WAF rules as needed.
• Build automation and internal tooling, primarily in Python, that reduces manual work for the security team.
• Contribute to security log pipelines, SIEM detections, and endpoint security controls.
• Help embed security checks, such as scanning and secrets detection, into CI/CD pipelines in partnership with DevOps.
• Contribute to secure development and infrastructure standards, playbooks, and enablement materials used across engineering.

Requirements

• 8+ years of hands-on security engineering experience.
• Strong, demonstrated depth in one of the following, with working knowledge of the other two: application security, cloud security, or security automation and tooling.
• Working knowledge of threat modeling.
• Operates independently and drives projects without day