Senior Corporate Security Engineer — LLM-Driven Defense

Material Security, Inc.; San Francisco (CA); Teletrabalho; USD 220 000 - 240 000; Tempo integral

Resumo da oferta

Material Security is seeking a security leader to harden our corporate environment and build rigorous, measurable defenses around our Google Workspace and production systems. You will own detection and response, design LLM-driven triage, and partner with Engineering to translate insights into product improvements.

The role requires hands-on ownership of a modern Mac fleet, SIEM and EDR deployments, and expanding phishing-resistant IAM across SaaS apps.

Qualificações

• 6+ years in corporate or enterprise security or detection and response.
• Proficient in Python, Go, or TypeScript and able to automate enforcement.
• Deep understanding of OAuth, SAML/OIDC, session and token lifecycle.
• Experience managing a Mac fleet with a modern MDM and EDR.
• Experience with or experiments in LLM-driven workflows.
• Nice to have contributed security features to a product codebase or open-source tooling.
• Collaborative, curious, direct working style.

Responsabilidades

• Detection and Response (own): Own corporate telemetry and the detection content on it. Close coverage gaps, reduce noise with measured fidelity, and build detections for what matters here: account takeover, session token theft, malicious OAuth grants, admin abuse, and exfiltration by someone who legitimately has access.
• LLM-Driven Triage (own): Design and build the agent that reviews privileged access grants, customer data access, and high-fidelity endpoint and identity alerts in near real time, with labeled evaluation sets, measured precision and recall, explicit limits on automated action, and a defense against being steered by log content or an employee's reply.
• Endpoint (shared with the CorpSec team): Device management and endpoint detection for the Mac fleet. Automate update enforcement, deepen EDR coverage, bring browser-level DLP to the fleet, and enforce BYOD posture on iOS and Android.
• Identity and SaaS (shared with the CorpSec team): The identity provider and the SaaS estate. Maintain phishing-resistant authentication everywhere, address the applications that cannot do SSO, automate access-review evidence, and turn manual vendor and OAuth application review into a pipeline.
• Google Workspace (shared with the CorpSec team): Admin alerting, OAuth governance, Apps Script governance, sharing, and DLP, using our own product where it fits. Partner with Engineering to propose, test, and ship detection updates to the product based on what you see in our own tenant.
• Corporate to Production (shared with AppSec): The boundary between corporate and production: detections that cross it, just-in-time access, and the logging that shows who touched what.

Conhecimentos

Python

Go

TypeScript

SIEM

Incident response

Descrição da oferta de emprego

Material Security is seeking a security leader to harden our corporate environment and build rigorous, measurable defenses around our Google Workspace and production systems. You will own detection and response, design LLM-driven triage, and partner with Engineering to translate insights into product improvements.

The role requires hands-on ownership of a modern Mac fleet, SIEM and EDR deployments, and expanding phishing-resistant IAM across SaaS apps.