Accountabilities

As a Staff Security Engineer, you will define technical security direction, lead risk reduction initiatives, and work alongside engineering teams to build secure and scalable systems. Your responsibilities will include:

Partner with product managers and engineers from the earliest stages of development to conduct threat modeling, review architecture designs, and establish security requirements.

Design and implement product security capabilities, including Single Sign-On (SSO), System for Cross-domain Identity Management (SCIM), granular access controls, audit logging, encryption, and key management.

Identify systemic security risks across the engineering environment, prioritize remediation efforts, and lead long-term initiatives that eliminate entire categories of vulnerabilities.

Develop and promote secure-by-default configurations, shared security libraries, reusable infrastructure components, and engineering guardrails.

Establish security baselines for cloud and Kubernetes environments, covering RBAC, network policies, pod security standards, workload identity, secrets management, and admission controls.

Define and implement security strategies for AI adoption and development, including threat modeling for AI-powered features and agentic workflows.

Address AI-specific risks such as prompt injection, sensitive data exposure, and excessive agent permissions.

Establish security guardrails for internal AI coding tools, autonomous agents, and Model Context Protocol (MCP) integrations.

Evaluate new AI vendors and integrations in collaboration with engineering, IT, and legal stakeholders.

Strengthen the secure software development lifecycle across design, code review, build, release, and deployment.

Manage and improve GitHub organization security and CI/CD pipeline configurations, including access controls, branch protection, GitHub Actions permissions, secret scanning, dependency scanning, and software supply chain security.

Define and implement a comprehensive secrets management strategy across applications, cloud infrastructure, CI/CD systems, and Kubernetes.

Centralize secrets in managed storage solutions, replace long-lived credentials with short-lived identity-based access, establish rotation standards, and remediate exposed or hardcoded secrets.

Build trusted relationships with engineering and product leaders, influence security decisions, and ensure security priorities are incorporated into team roadmaps.

Provide technical leadership and mentorship to security engineers while improving security awareness and capabilities across engineering teams.

Leverage AI tools to automate security workflows, improve design reviews, and scale security operations.

Requirements

The ideal candidate combines deep security engineering expertise with strong technical leadership and the ability to influence engineering decisions across an organization. You should have extensive experience securing complex software environments, implementing scalable security solutions, and translating technical risks into practical improvements. Key qualifications include:

At least 10 years of experience in security engineering, software engineering, or infrastructure engineering, with substantial experience in product or infrastructure security.

Proven track record of partnering with product and engineering teams to deliver security features and platform-level improvements.

Deep understanding of the software development lifecycle, including design, code review, CI/CD, build, release, and deployment processes.

Ability to read application code and pipeline configurations and identify security weaknesses.

Hands-on experience securing GitHub organizations, including SSO, access management, branch protection, rulesets, CODEOWNERS, required reviews, and GitHub Actions security.

Experience implementing least-privilege workflow permissions, OIDC integrations with cloud providers, third-party action pinning, secret scanning, push protection, and GitHub App and personal access token controls.

Strong experience designing and implementing secrets management strategies using solutions such as HashiCorp Vault, Google Cloud Secret Manager, or AWS Secrets Manager.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1