Senior Staff Security Engineer

Description

The company is headquartered in Seattle, has offices in more than 30 countries, serves over 550,000 customers worldwide, and is a market leader in data resilience and data security posture management.

The security engineering team builds and runs the security platform for a multi-cloud SaaS product on Azure and AWS, used by regulated industries.

This role sits in the Platform and AI area. You will set technical direction with the other technical leads across software supply chain security, secure AI sandboxes and vulnerability management, working with Product Engineering, SRE, Corporate Technology and Compliance. You will be judged on the mechanisms you deliver, not the advice you give.

Your daily stack includes Terraform, Azure services such as Entra ID, RBAC, Key Vault, Azure Policy, Defender for Cloud, Container Instances, AKS, Container Registry and managed identity with workload identity federation, plus AWS equivalents, CSPM and ASPM tools, GitHub Actions, GitHub Apps and Azure DevOps, Sigstore/cosign, SBOMs in CycloneDX or SPDX, SLSA-aligned builds, Anthropic Claude and Azure OpenAI, Python and Go (with reading PowerShell and TypeScript), and Microsoft Sentinel with Log Analytics for the audit trail.

Responsibilities

• Shape software supply chain security across the company's SaaS platforms, alongside the other technical leads.
• Design secure AI practices and patterns for the SaaS platforms.
• Run vulnerability management as an engineered system with the other technical leads.
• Ship security controls as Terraform code.
• Automate routine operational work to cut toil.
• Raise the engineering standard across the team.
• Take part in an on-call rotation.

Requirements

• 8+ years in security and engineering, recently deep in cloud platform security with hands-on delivery.
• Production Terraform at scale: modules other teams consume rather than one-off stacks, and judgment about when a control belongs in code instead of a runbook.
• Security expertise in AI and LLMs, including prompt injection, indirect prompt attack surfaces, agent tool-boundary abuse and model exfiltration.
• Deep Azure knowledge: Entra ID and RBAC, Key Vault and key handling, network egress, workload and managed identity, policy enforcement, and where platform defaults leave gaps.
• Practical software supply chain security: dependency risk, build pipeline integrity, provenance and signing, and judgment about which controls justify the developer friction they cause.
• Hands-on ownership of vulnerability management as an engineer: ingestion, deduplication, routing, SLA design and measurable reduction rather than a dashboard.
• Experience designing isolation boundaries for untrusted code execution across network, identity and data, backed by a threat model you can defend.
• Python or Go skills sufficient to build and maintain systems, not only configure vendor products.
• A track record of setting technical direction that others followed, and of shipping production code you can point to.
• This is a hands-on building role, not an advisory one.
• Familiarity with regulated-industry expectations (SOC 2 Type 2, ISO 27001, FedRAMP, HITRUST) and what auditors accept as evidence.
• Bonus: hands-on experience with agentic development environments (Claude Code, Cursor, GitHub Copilot Enterprise) and their operational security implications.
• Bonus: CSPM and ASPM tooling at production scale, including tuning signal into a queue the team owns and closes.
• Bonus: Kubernetes and container security (AKS, EKS), covering runtime detection, admission control and image policy.
• Bonus: Sigstore, SLSA, in-toto or equivalent provenance frameworks.
• Bonus: AWS depth alongside Azure.
• Bonus: contributions to open-source security, supply chain or LLM safety tooling.
• Bonus: relevant certifications (Azure or AWS security specialty, GIAC, or similar).

Conditions

Equal opportunity employer: discrimination on the basis of race, color, religion, gender, age, national origin, citizenship, disability, veteran status or any other protected classification under federal, state or local law is not tolerated.

Your information is kept confidential.

Benefits

• 26 paid days off a year, plus 4 extra global VeeaMe Days for self-care.
• 24 paid volunteer hours a year through Veeam Cares.
• Paid parental, maternity and paternity leave.
• Family medical plan, dental, rehab and vaccinations, fully covered.
• Life, critical illness and disability insurance.
• Employer pension contribution via PPK.
• Monthly Edenred meal allowance of 450 PLN.
• MultiSport card fully covered, giving access to sports facilities nationwide.
• Up to 12 free therapy sessions a year, plus legal and financial advice.
• Learning through LinkedIn Learning and O'Reilly on-demand libraries, mentoring, workshops and events such as the annual Global Day of Learning.