Senior Engineer, Cybersecurity

The New York Times Company; New York (NY); Hybrid; USD 140,000 - 160,000; Full time

Benefits offered by this job

Annual bonus

Restricted stock

Medical, dental and vision benefits

401(k) with company match

Employee stock purchase plan

Job summary

The New York Times Company is seeking a Senior Engineer, Cybersecurity to design, build, and operate security controls protecting our systems, data, and users. As part of the Security Architecture team, you will own initiatives end-to-end, drive risk reduction, and collaborate with product engineering and enterprise technology to secure our products and services.

You will partner with engineering teams to integrate security into architecture and developer workflows, perform threat modeling, and

Qualifications

• 5+ years of experience in software engineering and security engineering space.
• Understanding of security controls across a variety of security domains, including access management, encryption, vulnerability management, AI security, network security, authentication/authorization.
• Knowledge of one or more Cloud platforms (AWS, GCP) and best practices for architecting and securing.
• Experience with software engineering practices (CI/CD, GitOps, IaC, etc.) and related security practices (SAST, SCA, secure by design, shift left, etc.).
• Programming skills in at least one language (Go, Python).
• Experience with containerization and orchestration platforms.

Responsibilities

• Create an environment that favors context, not control. Empower product engineers and ensure they have the relevant information and tools to deliver secure products and services.
• Design, implement, and operate security controls and services that meet reliability, security, scalability, and observability standards.
• Partner with product and platform teams to integrate security into architecture and developer workflows while articulating business impact and tradeoffs.
• Perform security reviews, threat modeling, and risk assessments (code, design, 3rd-party apps).
• Investigate and resolve urgent and/or complex security issues, triaging effectively and driving architectural changes that prevent recurrence.
• Demonstrate support and understanding of our value of journalistic independence and a commitment to our mission to seek the truth and help people understand the world.

Skills

Go

Python

CI/CD

GitOps

IaC

Cloud AWS

Cloud GCP

Security engineering

On-call readiness

Tools

Kubernetes

Terraform

Packer

HashiCorp Vault

CI tooling

Job description

The mission of The New York Times is to seek the truth and help people understand the world. That means independent journalism is at the heart of all we do as a company. It’s why we have a world-renowned newsroom that sends journalists to report on the ground from nearly 160 countries. It’s why we focus deeply on how our readers will experience our journalism, from print to audio to a world-class digital and app destination. And it’s why our business strategy centers on making journalism so good that it’s worth paying for.

About the Role, Mission or Department Overview

The Senior Engineer, Cybersecurity is a hands-on contributor who designs, builds, and operates security controls and services that protect The Times' systems, data, and users. As a member of the Security Architecture team, you will own complex initiatives end-to-end, drive measurable risk reduction, and collaborate across product engineering and enterprise technology with technical depth, operational rigor, and clear communication aligned with business outcomes.

Who are we?

Cybersecurity helps prevent The Times from becoming news. Our teams work to protect the news makers, their support staff, the platforms they rely on every day, as well as all of The Times' products and services, and our readers who consume them.

This role reports to the Director of Engineering, Cybersecurity.

Responsibilities:

• Create an environment that favors context, not control. Empower product engineers and ensure they have the relevant information and tools to deliver secure products and services.
• Design, implement, and operate security controls and services (e.g., identity and access management, secrets management, endpoint/agent hardening, network segmentation, detection, and response automation) that meet reliability, security, scalability, and observability standards.
• Partner with product and platform teams to integrate security into architecture and developer workflows while articulating business impact and tradeoffs.
• Perform security reviews, threat modeling, and risk assessments (code, design, 3rd-party apps).
• Investigate and resolve urgent and/or complex security issues, triaging effectively and driving architectural changes that prevent recurrence.
• Participate via RFCs, community of practices, and other internal knowledge sharing channels to share learnings, align on standards, and influence secure patterns across areas; model The Times' core values in cross-functional collaboration.
• Support team growth through peer design/code review, pairing, and clear feedback; on security engineering practices across the department.
• Demonstrate support and understanding of our value of journalistic independence and a commitment to our mission to seek the truth and help people understand the world.

Basic Qualifications:

• 5+ years of experience in software engineering and security engineering space.
• Understanding of security controls across a variety of security domains, including access management, encryption, vulnerability management, AI security, network security, authentication/authorization.
• Knowledge of one or more Cloud platforms (AWS, GCP) and best practices for architecting and securing.
• Experience with software engineering practices (CI/CD, GitOps, IaC, etc.) and related security practices (SAST, SCA, secure by design, shift left, etc.).
• Programming skills in at least one language (Go, Python).
• Experience with containerization and orchestration platforms.
• A bias towards helping people. Many teams will rely on you to help build their systems.

Preferred Qualifications:

• Security/Compliance or DevOps certifications
• Experience with Kubernetes
• Experience with Terraform and Packer
• Experience with HashCorp Vault

This role may require limited on-call hours. An on-call schedule will be determined when you join, based on team size and other factors.

This is a hybrid remote/in-office role.

#LI-Hybrid

REQ-020730

Additional Compensation and Benefits:

For roles in the U.S., dependent on your role, you may be eligible for variable pay, such as an annual bonus and restricted stock. Benefits may include medical, dental and vision benefits, Flexible Spending Accounts (F.S.A.s), a company-matching 401(k) plan, employee stock purchase plan, paid vacation, paid sick days, paid parental leave, tuition reimbursement and professional development programs.

For roles outside of the U.S., information on benefits will be provided during the interview process.

The annual base pay range for this role is between:

$140,000 - $160,000 USD

Candidate Use of GenAI Tools:

We’re excited to learn more about you and your experience. To keep our hiring process as fair and authentic as possible, we ask that you submit your own work and not use GenAI tools to generate substantive content during the application and interview process.

If you’re an engineering candidate, we’ll let you know what specific GenAI tools you are permitted to use for your technical assessment.

The New York Times Company is committed to being the world’s best source of independent, reliable and quality journalism. To do so, we embrace a diverse workforce that has a broad range of backgrounds and experiences across our ranks, at all levels of the organization. We encourage people from all backgrounds to apply.

We are an Equal Opportunity Employer and do not discriminate on the basis of an individual's sex, age, race, color, creed, national origin, alienage, religion, marital status, pregnancy, sexual orientation or affectional preference, gender identity and expression, disability, genetic trait or predisposition, carrier status, citizenship, veteran or military status and other personal characteristics protected by law. All applications will receive consideration for employment without regard to legally protected characteristics. The U.S. Equal Employment Opportunity Commission (EEOC)’s Know Your Rights Poster is available here.

The New York Times Company will provide reasonable accommodations as required by applicable federal, state, and/or local laws. Individuals seeking an accommodation for the application or interview process should email [e-mail]. Emails sent for unrelated issues, such as following up on an application, will not receive a response.

For information about The New York Times' privacy practices for job applicants, click here.