Staff Security Engineer - Security and Compliance

Description

The company helps organizations understand, secure and recover their data and AI so they can adopt AI safely at scale.

It is a market leader in data resilience and data security posture management, with its headquarters in Seattle, offices in more than 30 countries and over 550,000 customers.

This role sits within the team behind a data command center for data security, privacy, governance and AI security, which is now part of the company.

It is a senior individual-contributor position that provides hands-on technical leadership across product and application security.

Responsibilities

• Own and develop the secure development lifecycle for the whole product portfolio, covering threat modeling, design reviews, secure code review and security testing.
• Set security direction for AI features such as LLM-powered functions, agents and copilots, including prompt injection, retrieval leakage, permissions and model supply chain risk.
• Tune SAST, dependency, secrets, container, infrastructure and SBOM scanning so results are useful and fit into engineering work.
• Run product vulnerability response: reproduce issues, assess severity, drive fixes, coordinate disclosure, handle CVEs and write customer advisories.
• Carry out focused penetration tests and security research on applications, APIs, agents, connectors and cloud services, and scope and check third-party testing.
• Harden the software supply chain with SBOMs, signed reproducible builds, dependency governance and safe release practices.
• Create shared security libraries, reference code, hardening guides and developer training, and grow a Security Champions program.
• Measure and report security metrics such as remediation time, critical and high findings, scan coverage and engineering adoption.
• Work with engineering on technical controls and evidence for SOC 2 Type II, ISO 27001 and 27701, ISO/IEC 42001, HIPAA, PCI and FedRAMP Moderate readiness.
• Turn GDPR, CCPA, the EU AI Act, DORA and NIS2 into concrete engineering requirements and release criteria.
• Confirm that audit and penetration test findings are fixed, and raise material risks to leadership when needed.
• Act as the technical security contact for customer due diligence, audits, questionnaires, AI risk reviews and executive briefings.
• Bring security risk into architecture and roadmap decisions alongside Engineering, Product, Platform, SRE and the company's corporate security team.
• Shape engineering standards and security strategy through influence rather than formal authority.
• Represent the company in technical discussions with customers, auditors, standards bodies and the security research community.

Requirements

• 8+ years in security, including substantial application or product security work on SaaS or cloud-native platforms.
• Strong coding and code review in at least one of Go, Python, Java or TypeScript, with the ability to confirm vulnerabilities and build security tooling.
• Deep knowledge of multi-tenant cloud security on AWS, Azure or GCP, covering IAM, Kubernetes, secrets, tenant isolation and protection of sensitive customer data.
• Hands-on work securing LLM-powered applications, including prompt injection, retrieval leakage, agent authorization and model supply chain risk.
• A proven record of building or significantly improving a secure SDLC across several engineering teams.
• Experience leading vulnerability response or coordinated disclosure, including severity assessment, CVE work, remediation and customer communication.
• Working knowledge of software supply chain security, such as SBOMs, signing, SLSA and SSDF.
• Working experience with assurance frameworks such as SOC 2, ISO 27001 or FedRAMP.
• Ability to explain technical risk clearly to engineers, executives, auditors and customers.
• A degree in computer science or engineering, or equivalent practical experience.
• Bonus: experience with DSPM, privacy engineering, data governance, CASB, DLP or other platforms that handle highly sensitive customer data.
• Bonus: experience supporting FedRAMP Moderate or ISO/IEC 42001 on a SaaS platform.
• Bonus: familiarity with OWASP guidance for LLM applications, NIST AI RMF and privacy-by-design principles.
• Bonus: certifications such as CISSP, CSSLP, OSCP/OSWE, CCSP or GIAC.
• Bonus: published security research, CVE credits, conference presentations or open-source security tooling.
• Bonus: experience working across US and Asian time zones.

Conditions

Pay is based on expected total target compensation of $289,320 to $537,360 USD, which includes base pay and a performance-based bonus.

The company considers experience, education, skills and geographic zone when setting pay, and offers are typically made below the midpoint of the range.

The company is an equal opportunity employer that does not tolerate discrimination based on race, color, religion, gender, age, national origin, citizenship, disability, veteran status or any other class protected by federal, state or local law, and applicant information is kept confidential.

Benefits

• Unlimited PTO, 12 paid holidays and 4 global VeeaMe Days for self-care.
• 24 paid volunteer hours a year through the company's Cares volunteer program.
• 8 weeks of paid parental leave for all parents, and 16 weeks for birthing parents.
• Health, dental and vision cover that begins on day one.
• Employee Assistance Program with mental health support, therapy sessions and digital wellness tools.
• 401(k) plan with company matching contributions.
• Fertility, adoption and surrogacy support through Maven, plus paid volunteer time.
• AirVet, offering 24/7 virtual veterinary care at no cost.
• Legal services, identity protection and supplemental health insurance options.
• Tax-advantaged accounts for healthcare, dependent care and commuting costs.
• Learning resources including LinkedIn Learning and O'Reilly libraries, mentoring, workshops and events such as the annual Global Day of Learning.