LLM-Driven Enterprise Security Engineer (Remote)

Material Security, Inc.; San Francisco (CA); Hybrid; USD 220,000 - 240,000; Full time

Benefits offered by this job

Remote-first

Job summary

Material Security, Inc. is seeking a security leader to own detection and response across a corporate telemetry stack, including IAM, devices, SaaS, and collaboration.

You will design LLM-driven triage, strengthen Mac EDR, and govern Google Workspace security, while partnering with Engineering to ship new detections. You will drive incident response, automate protections, and ensure secure handling of customer data; you will work in a remote-first startup with an SF office and a compensation

Qualifications

• 6+ years in corporate or enterprise security or detection and response.
• Hands-on ownership of a SIEM, detection content, and incident response.

Responsibilities

• Detection and Response (own): Own corporate telemetry and the detection content. Close coverage gaps, reduce noise with measured fidelity, and build detections for threats. Lead corporate incident response and own the playbooks.
• LLM-Driven Triage (own): Design and build the agent that reviews privileged access grants, customer data access, and high-fidelity endpoint and identity alerts with measured precision and explicit limits on automated action.
• Endpoint (shared with CorpSec): Device management and endpoint detection for the Mac fleet; automate update enforcement; deepen EDR coverage; enforce BYOD posture.
• Identity and SaaS (shared with CorpSec): Maintain phishing-resistant authentication; automate access-review evidence; review OAuth apps and vendor access.
• Google Workspace (shared with CorpSec): Admin alerting, OAuth governance, Apps Script governance, sharing, and DLP; collaborate with Engineering to ship detection updates.
• Corporate to Production (shared with AppSec): Manage the boundary between corporate and production with detections that cross it and just-in-time access.

Skills

SIEM ownership

Incident response

Endpoint security

Python/Go/TypeScript

Detection & response

Education

6+ years security experience

Tools

MDM

EDR

Google Workspace

Job description

Material Security, Inc. is seeking a security leader to own detection and response across a corporate telemetry stack, including IAM, devices, SaaS, and collaboration.

You will design LLM-driven triage, strengthen Mac EDR, and govern Google Workspace security, while partnering with Engineering to ship new detections. You will drive incident response, automate protections, and ensure secure handling of customer data; you will work in a remote-first startup with an SF office and a compensation