Principal Compliance & Security Engineer

Mrbeast; San Mateo (CA); On-site; USD 205,000 - 256,000; Full time

Benefits offered by this job

Medical benefits

HSA contributions

401k matching

Flexible vacation

Tech package

Relocation assistance

Job summary

Beast Industries is seeking a Principal Compliance & Security Engineer to bridge security engineering and compliance across Step, Feastables, and the media org. You will define secure-by-default patterns, automate evidence collection, and lead audits with PCI DSS and SOC 2 frameworks.

You’ll own security architecture, map controls to regulations, and drive risk-informed decisions while working with auditors and regulators to ensure continuous compliance in a fast-moving AI-first environment.

Qualifications

• Around 15 years of combined security engineering and compliance experience, with proven ownership of PCI DSS and SOC 2 in production.
• Cloud security, application security, threat modeling, and incident response experience; ability to read and reason about code.
• Strong communication of risk and regulatory requirements in business terms; experience standing up security/compliance for fintech or data-heavy products.

Responsibilities

• Set security standards across cloud infrastructure, apps, and data systems.
• Lead threat modeling and security reviews for high-risk products and data involving minors/payments.
• Manage vulnerability program and drive remediation to closure with owning teams.
• Build and own incident response, playbooks, escalation, post-incident reviews, and breach readiness.

Skills

AI-native security

Security engineering

Compliance engineering

Threat modeling

Incident response

Audit leadership

Cloud security

Regulatory mapping

Terraform

Policy as code

Tools

AWS

GCP

Job description

Principal Compliance & Security Engineer

San Mateo, CA

About Us

Beast Industries is a multifaceted media and entertainment company founded by Jimmy Donaldson, popularly known as MrBeast, the most watched person in the world. Renowned for revolutionizing digital content creation, Beast Industries encompasses a diverse portfolio of ventures that extend far beyond its origins on YouTube. With a mission to entertain, inspire, and create significant social impact, Beast Industries operates across various domains including digital media, philanthropy, consumer products, and innovative business initiatives. At Beast Industries, we believe in the transformative power of digital media and its potential to entertain, educate, and effect positive change. Our commitment to innovation, creativity, and philanthropy drives us to explore new frontiers, create unforgettable experiences, and build a legacy that inspires future generations.

Principal Compliance & Security Engineer

The Opportunity

We're doing an AI-first engineering rebuild for a company that already has an audience of 100M+ people. This is a zero-to-one build with no legacy constraints, which means you get to stand up the security and compliance foundation correctly from the start. The stakes here are concrete: Step handles money and serves minors, Feastables carries consumer and supply-chain data, and the media business ships fast and constantly. You're here to make regulated products shippable without slowing them down.

The Mandate

You'll be a single principal-level IC bridging two disciplines that usually live on separate teams: security engineering (threat modeling, vulnerability management, hardening, incident response) and compliance engineering (control design, audit evidence, framework mapping across SOC 2, PCI DSS, COPPA, and privacy law). That means:

• Own the security architecture and the technical compliance posture across Step, Feastables, and the media org.
• Build one control framework, with each control mapped to the regulation it satisfies (PCI DSS, COPPA, GDPR/CCPA, SOC 2).
• Make compliance continuous by automating evidence collection and control monitoring, not a once-a-year scramble.

What You'll Do

• Set the security standards other engineers build against across cloud infrastructure, applications, and data systems.
• Lead threat modeling and security reviews for high-risk products, especially Step's payment and account systems and anything touching minors' data.
• Run the vulnerability management program and drive remediation to closure with the teams that own the systems.
• Build and own incident response: detection, playbooks, escalation, post-incident review, and breach-notification readiness.
• Act as technical lead during PCI DSS and SOC 2 audits, and represent Beast with auditors, regulators, and partners.
• Translate regulatory requirements into engineering work teams can act on, and advise leaders on risk tradeoffs in plain terms.
• Define secure-by-default patterns and paved paths so most teams meet requirements without one-off review.

Who You Are

• AI-Native: You're already using AI daily and bringing it into security work where it earns its place, from automation to evidence pipelines.
• Security + Compliance Hybrid: Around 15 years of combined security engineering and compliance experience, with proven ownership of PCI DSS and SOC 2 in production, from control design through a successful audit.
• Applied and Hands-On: Strong cloud security (AWS/GCP), application security, threat modeling, and incident response, with the ability to read and reason about code.
• Trusted on Risk: You say no clearly when risk warrants it and explain the tradeoff in terms the business can act on, you treat minors' data and customer money as the highest bar, and you influence through evidence, not title.

Working knowledge of privacy and minor-protection regulation (COPPA, GDPR, CCPA) and how it maps to technical controls. Bonus points for fintech or payments experience (money movement, KYC), security automation and infrastructure-as-code (Terraform, policy-as-code), relevant certifications (CISSP, CCSP, OSCP), and standing up a security or compliance function from an early stage.

• Compensation: Base of $205K-$256K +15% bonus + equity

The Perks, Why Work On the MrBeast Team

We are redefining what entertainment and storytelling look like at global scale. Every piece of content we publish reaches millions and influences culture in real time. This is your opportunity to lead the team that decides how those moments come to life across every screen.

• Generous Medical (Blue Cross Blue Shield), Dental, Vision and company-paid Life Insurance
• Company contributions to employee Health Savings Accounts (HSA)
• 401k Plan with Safe Harbor company-matching
<
• Flexible vacation policy and paid company holidays
• Company-provided technology package
• Relocation assistance where applicable, including travel and company-provided housing for the first 90 days

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in MrBeast’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.