Accountabilities

As the technical lead for security, you will establish priorities, drive security initiatives, and work hands-on to protect products, infrastructure, and internal operations. Your main responsibilities will include:

Define and lead the overall security strategy and roadmap, establish priorities, set standards, and drive execution across the organization.

Identify security gaps and develop practical solutions, including building tools, automation, and processes alongside other security engineers.

Integrate security into the software development lifecycle through pull request reviews, threat modeling, dependency management, secrets detection, and software supply chain security.

Strengthen operational security while maintaining a flexible, high-trust working environment and aligning practices with industry standards.

Manage day-to-day security operations, including security requests, internal support, maintenance, and continuous improvements, while automating manual processes wherever possible.

Lead security incidents from detection through resolution, including incident communications, customer updates, and postmortems.

Participate in the engineering-wide on-call rotation, organize incident response exercises, and ensure identified security gaps are addressed.

Assess and secure AI-powered systems, including internal agents, MCP servers, connectors, and in-product AI features, by conducting threat modeling and establishing appropriate safeguards.

Manage vulnerability disclosure activities, assess external security reports, prioritize legitimate findings, and coordinate remediation.

Oversee security compliance initiatives, particularly SOC 2 and Meta platform compliance, ensuring that controls improve actual security rather than simply satisfying audit requirements.

Support customer trust initiatives by responding to security questionnaires, collaborating with customer-facing teams, and developing resources such as a Trust Center.

Partner with product engineering teams on technical specifications, security reviews, and the development of security champions across the organization.

Requirements

The ideal candidate is an experienced security professional who combines technical depth, independent leadership, and a collaborative mindset. You should be comfortable setting direction, solving complex security challenges hands-on, and influencing engineering decisions in a distributed environment. The following qualifications and skills are expected:

Significant experience as a senior security engineer or security lead, ideally as the most senior security specialist in an organization without a CISO above you.

Strong hands-on expertise in application and API security within multi-tenant SaaS environments, preferably involving public APIs.

Deep understanding of authorization models, OAuth, OIDC, authentication and session management, IDOR, SSRF, and threat modeling.

Proven ability to identify, investigate, and remediate security vulnerabilities rather than simply report them.

Strong programming skills, particularly in TypeScript, with the ability to navigate, modify, and contribute to existing codebases. Familiarity with PHP and Python is also valuable.

Experience leading security incidents end-to-end, including technical response, stakeholder communications, customer updates, and actionable postmortems.

Working knowledge of AWS, Kubernetes, and Cloudflare, or comparable technologies, with the ability to assess infrastructure risks and collaborate effectively with infrastructure teams.

Experience managing or contributing to SOC 2 or similar compliance programs, ideally with an emphasis on automating evidence collection.

Previous experience operating or triaging vulnerability disclosure or bug bounty programs, with the ability to distinguish genuine security issues from low-quality reports.

Strong communication and stakeholder management skills, including the confidence to challenge technical decisions constructively and collaborate toward effective solutions.

Familiarity with modern AI tools and their practical applications, alongside a strong understanding of the security risks associated with AI-powered systems and agents.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1