Staff Security Engineer, Product Security and Architecture

About the role

At Compass International Holdings (CIH), the Security organization protects one of the largest and most complex real estate technology estates in the industry. As a Staff Security Engineer, you will build security as a service—creating secure‑by‑design tooling, automated guardrails, and partnering with engineering teams to drive technical security results and shape roadmaps.

Responsibilities

• Automate & Scale Application Security: Build, enhance, and support automated application security testing frameworks and tooling to seamlessly integrate security into CI/CD pipelines.
• Drive Secure‑by‑Design Architectures: Partner with engineering teams to evaluate solution architectures and codebases, providing technical feedback that embeds secure‑by‑design principles from the start.
• Serve as a Trusted Security Advisor: Act as a key resource and subject‑matter expert for product and engineering teams, offering security guidance and risk evaluations for new product features, development processes, tooling, and services.
• Evangelize Product Security: Advocate for secure‑by‑design approaches across the organization to mature the overall security culture.
• Cultivate Collaboration: Build strong, collaborative relationships across Product and Engineering to help teams achieve delivery goals without compromising security.
• Secure & Accelerate with AI: Drive adoption of AI‑powered security capabilities (code/IaC scanning copilots, automated triage) and establish AI Security Posture Management (AI‑SPM) frameworks and secure‑by‑design standards to safely integrate AI into CIH products and protect enterprise data from threats such as prompt injection, model/data exfiltration, and unsanctioned “shadow AI” usage.
• Continuous Innovation: Stay ahead of industry trends, embracing new technologies to ensure security capabilities keep pace with evolving business and engineering objectives.

Requirements

• Bachelor’s degree in Computer Science, a related technical field, or equivalent practical work experience.
• Minimum of three (3) years of experience across the following areas:
  • Administering and configuring automated pipeline tools (CI/CD).
  • Administering and tuning application security testing tools (e.g., SAST, DAST, or SCA).
  • Automation scripting using Python or Bash.
  • Product development using Python, JavaScript, TypeScript, Golang, or Java.
  • Performing security code reviews for solutions built in Python, JavaScript, TypeScript, Golang, or Java.
  • Participating in security‑focused reviews for both vendor and custom business solutions.
  • Hands‑on experience with Infrastructure as Code (IaC) tools (e.g., Terraform) to provision secure, reproducible infrastructure.
  • Practical experience working with AWS services, aligning product solution delivery and security objectives.
  • Hands‑on experience using Artificial Intelligence (AI) to assist with product security processes to drive team and operational efficiencies.

Skills

• Relevant industry certifications (e.g., CEH, CISSP, CSSLP, GIAC, or cloud security certifications) – a strong plus.
• Direct experience working within high‑performing DevOps and Agile cultures.
• Experience with Layer 7 security controls (e.g., Web Application Firewalls (WAF), API Gateways, OAuth2/OIDC implementation, and rate limiting).
• Experience driving secure‑by‑design practices across multi‑cloud strategies (e.g., AWS, Azure, GCP).
• Experience reviewing and assessing the use of AI technologies within both vendor‑provided and custom‑developed business solutions.
• Experience operating in a publicly traded company, including familiarity with SOX‑adjacent control environments and audit processes.
• Experience securing environments through a merger, acquisition, or major infrastructure consolidation.

Benefits

• Participation in incentive programs (eligible cash,