Staff Software Engineer - Platform Security

Description

The Platform Security Team builds core security infrastructure and AI-driven detection systems for large-scale enterprise operations.

The Outbound Security group owns the controls on traffic leaving the platform: egress filtering and policy, outbound proxying, SSRF protection, data exfiltration prevention, and workload egress identity for a SaaS product.

This is core security engineering in a regulated environment.

The title for this role is Staff AI Security & Outbound Security Engineer. The role centers on building enterprise-scale security solutions that combine outbound security systems with machine learning, reasoning engines, and real-time inference.

You will work hands-on with network and application egress security, lead technical work, and apply machine learning in practice.

You will design and run adaptive security systems for egress control, outbound proxy infrastructure, and exfiltration detection at SaaS scale.

Responsibilities

• Design, build, and maintain scalable outbound security services that meet FIPS compliance and regulated-environment requirements.
• Architect and run mission-critical egress services, treating reliability and security as core design constraints from the start.
• Own services end to end on Kubernetes in a multi-tenant SaaS setting, covering deployment, scaling, on-call rotations, and incident response.
• Threat model every feature during design reviews, including failure and abuse cases, not only the expected path.
• Assess where AI and ML fit in outbound security, such as anomaly detection in egress traffic, ML-assisted destination risk scoring, and AI-assisted code review for SSRF and unsafe outbound-request patterns, and reject uses that add little value.
• Work with product owners, security architects, and platform teams to turn compliance and security requirements into working outbound security frameworks.
• Coach engineers on secure coding, common outbound-request pitfalls such as SSRF, DNS rebinding, open redirects, and unrestricted egress, and rigorous design review.
• Track evolving exfiltration techniques and egress security advances, including post-quantum readiness for outbound TLS, and adopt them ahead of compliance deadlines.

Requirements

• At least 8 years of professional software engineering experience, including production work in Java, Go, or another strongly typed language.
• Solid computer science fundamentals: data structures, algorithms, object-oriented design, and distributed systems tradeoffs.
• Hands-on experience running services on Kubernetes in a SaaS or multi-tenant setting, including deployments, Helm, and CI/CD. This is a baseline expectation, not a bonus.
• Working knowledge of core network and application security: TCP/IP, DNS, HTTP, TLS and PKI fundamentals, proxies, firewalls, and allowlisting and denylisting.
• A security-first approach shown through secure coding, threat modeling, and disciplined code review.
• Preferred: direct experience with outbound or egress security, forward proxies, SSRF mitigation, DNS security, or data loss and exfiltration prevention, such as egress gateways, network policy enforcement, or TLS inspection.
• Preferred: experience with authentication and authorization, IAM, certificates, identity, secure connectivity, and external network topology.
• Preferred: some hands-on use of AI and ML on security or operations problems, such as anomaly detection, risk scoring, or log and telemetry analysis, or careful use of LLM tools in engineering work. Research background is not required.
• Preferred: experience in regulated environments such as FIPS 140-2 or 140-3, FedRAMP, Common Criteria, or similar.
• Preferred: exposure to post-quantum cryptography in outbound TLS and secure communications.
• Preferred: a record of mentoring engineers and raising the security bar on a team, beyond shipping features.

Conditions

Base pay for this role in this location is $149,800 to $262,200. Pay is a guideline; total compensation depends on qualifications, skill level, competencies, and work location, and it is set by geographic location and may change.

Equity is offered where applicable, along with variable incentive compensation and benefits.

Work arrangement is a persona assigned by the nature of the work and the assigned location: flexible, remote, or required in office.

To confirm eligibility for a persona, the company may measure the distance between your main residence and the nearest office using a third-party service.

Benefits

• Health plans, including flexible spending accounts.
• 401(k) plan with company match.
• Employee stock purchase plan (ESPP).
• Matching donations.
• Flexible time away plan.
• Family leave programs.