Staff Security Engineer

The Staff Security Engineer will play a key role in strengthening product, infrastructure, and application security across a leading product analytics platform. Working within the Information Security and Risk Management team, you will partner closely with product and engineering leaders to embed security into every stage of software development. You will lead strategic initiatives covering cloud infrastructure, Kubernetes, CI/CD pipelines, secrets management, and secure product design. A major focus will be defining security standards for AI adoption, including AI-powered features, autonomous agents, and internal development tools. Rather than relying on isolated fixes, you will drive long-term, platform-level solutions that eliminate systemic risks. This is a hands-on technical leadership opportunity with significant influence over engineering practices, security architecture, and organizational resilience.

The ideal candidate combines deep security engineering expertise with strong technical leadership and the ability to influence engineering decisions across an organization. You should have extensive experience securing complex software environments, implementing scalable security solutions, and translating technical risks into practical improvements. Key qualifications include:

• At least 10 years of experience in security engineering, software engineering, or infrastructure engineering, with substantial experience in product or infrastructure security.

• Proven track record of partnering with product and engineering teams to deliver security features and platform-level improvements.

• Deep understanding of the software development lifecycle, including design, code review, CI/CD, build, release, and deployment processes.

• Ability to read application code and pipeline configurations and identify security weaknesses.

• Hands-on experience securing GitHub organizations, including SSO, access management, branch protection, rulesets, CODEOWNERS, required reviews, and GitHub Actions security.

• Experience implementing least-privilege workflow permissions, OIDC integrations with cloud providers, third-party action pinning, secret scanning, push protection, and GitHub App and personal access token controls.

• Strong experience designing and implementing secrets management strategies using solutions such as HashiCorp Vault, Google Cloud Secret Manager, or AWS Secrets Manager.

• Knowledge of workload identity, short-lived credentials, automated secret rotation, and detection and response processes for exposed credentials.

• Extensive product and application security expertise, including threat modeling, secure design reviews, authentication and authorization vulnerabilities, and multi-tenant isolation.

• Experience designing and implementing security features such as SSO (SAML/OIDC), access controls, audit logging, and encryption.

• Strong infrastructure security experience with GCP or AWS, including IAM, network security, and Infrastructure as Code tools such as Terraform.

• Production experience securing Kubernetes environments, including cluster hardening, RBAC, network policies, admission controllers, and container image security.

• Experience securing AI and LLM-based systems or supporting organization-wide AI adoption.

• Understanding of AI security risks, including prompt injection, sensitive data exposure, and insecure agent tool usage.

• Familiarity with security guidance such as the OWASP Top 10 for LLM Applications.

• Demonstrated ability to lead cross-functional security remediation initiatives, from problem identification and stakeholder alignment through implementation.

• Strong communication and relationship-building skills, with the ability to influence senior engineers and leaders without direct authority.

• Ability to communicate complex security concepts through clear design documentation and actionable engineering guidance.

• Hands-on experience using AI tools such as Claude Code to automate and scale security work.

Preferred Qualifications:

• Experience securing multi-tenant SaaS platforms or data analytics products.

• Knowledge of software supply chain security standards and tools, including SLSA, Sigstore, and Software Bill of Materials (SBOMs).

• Familiarity with service mesh technologies and zero-trust networking, including Istio and mutual TLS (mTLS).

• Experience implementing practical AI governance frameworks, including approved-tool policies, AI vendor assessments, and access controls for agents and MCP servers.

• Experience developing secure-by-default libraries, reusable security components, or standardized engineering platforms.

• Previous experience as a software engineer before transitioning into security, or equivalent experience working directly within engineering teams.

• Experience supporting SOC 2 or ISO 27001 security controls in engineering environments.

• Relevant professional certifications such as CKS, OSWE, OSCP, or equivalent.