Security Lead for AI-Driven SaaS (Remote)

Buffer; United States; Remote; USD 170,000 - 210,000; Full time

Job summary

Buffer is hiring a hands-on security engineer to be the tech lead for the Security team. You will set direction, write code, and co-lead incidents while maintaining a high-trust, remote-friendly culture.

You’ll collaborate with product engineering, own compliance and customer trust programs (SOC 2, audits), and help scale security across a growing AI-enabled platform. Remote, async, with international overlap.

Qualifications

• You’ve been the senior security person somewhere without a CISO above you. You know what it means to set direction without a mandate and earn it through work.
• You have hands-on application and API security depth in a multi-tenant SaaS, ideally one with a public API: authorization models, OAuth and OIDC, session and auth flows, IDOR and SSRF, and threat modeling. You've found these bugs and fixed them, not only reported them.
• You write code. You can read and change a TypeScript codebase well enough to ship a fix and review someone else’s (legacy PHP and Python show up more rarely, too).
• You’ve led security incidents end-to-end, including the writing of status updates, customer comms, and postmortems that people act on.
• You’ve worked with AWS, Kubernetes, and Cloudflare, or similar, enough to reason about infrastructure risk with an infrastructure team. You don’t need to run it.
• You’ve run a SOC 2 or similar program, or worked closely with one, and you’d rather automate evidence collection than do it by hand.

Responsibilities

• Lead security at Buffer. Define the strategy and roadmap, set priorities, drive execution, and change how we work where it matters.
• Build. Identify the problem, define the solution, then build it with Adnan: tooling, automation, processes.
• Put security in the development loop. Check on every PR, threat modeling in tech specs, dependency, secrets, and supply chain hygiene.
• Advance operational security. Secure our day-to-day operations to meet industry-wide standards while maintaining Buffer’s high-trust environment.
• Keep the lights on. Security inbox, requests from other teams, maintenance and chores, with automation where possible.
• Lead incidents and take part in our engineering-wide on-call rotation. Run tablets and postmortems to close gaps.

Skills

Security leadership

Threat modeling

App security

API security

Incident response

Automation

AWS

Kubernetes

Cloudflare

Datadog

Sentry

Incident.io

PagerDuty

1Password

GitHub Actions

Terraform

Tools

AWS

Kubernetes

Cloudflare

Datadog

Sentry

incident.io

PagerDuty

Terraform

Job description

Buffer is hiring a hands-on security engineer to be the tech lead for the Security team. You will set direction, write code, and co-lead incidents while maintaining a high-trust, remote-friendly culture.

You’ll collaborate with product engineering, own compliance and customer trust programs (SOC 2, audits), and help scale security across a growing AI-enabled platform. Remote, async, with international overlap.