Senior Engineer, Security Engineering

VTS; New York (NY); On-site; USD 160,000 - 200,000; Full time

Benefits offered by this job

Health benefits

401(k) plan

Equity

Flexible PTO

Job summary

VTS is seeking a Senior Engineer in New York, NY to strengthen security across applications, cloud infrastructure, and platform. You will define how we detect and close exposures before exploitation, owning detection, investigation, and response capabilities across global platforms.

You should read code, understand multiple systems languages, and lead vulnerability management and threat modeling. Four days in the office weekly are required.

Qualifications

• 8+ years of experience in Security Engineering, AppSec, Vulnerability Research, or Incident Response.
• Senior-level track record driving cross-team initiatives.
• Proficient reading of C, C++, Rust, Go, or ASM.
• Familiar with SOC 2/ISO 27001 compliance.
• Strong problem-solving and incident response mindset.

Responsibilities

• Own security incidents end-to-end from detection to remediation.
• Lead vulnerability management and threat modeling.
• Define secure design practices and CI/CD tooling.
• Mentor engineers on secure coding and threat modeling.
• Develop AI-native defense capabilities.

Skills

Security engineering

AI/ML defense

Vulnerability management

Secure coding review

Tools

Vault

AWS KMS/Secrets Manager

CI/CD tooling

SAST/DAST tooling

Job description

We are seeking an experiencedSenior Engineer to help strengthen and reinforce our security processes, workflows, and posture as it relates to our applications, cloud infrastructure, and platform. In this role, you won't just be patching what's already broken; you will be defining how we find and close exposures before they're used against us. You will own and engineer the detection, investigation, and response capabilities that protect our global platforms while leading the charge into AI-augmented defense, using AI to compress the time between a vulnerability's disclosure and its exploitation in the wild.

** Please note that this opportunity is located in New York, NY, and requires this hire to work from our office four days a week. **

What Makes This Job Awesome? You will…

• Security Architecture & Tooling: Own our SAST/DAST program end-to-end, selecting, tuning, and integrating static and dynamic analysis tooling into the CI/CD pipeline so vulnerabilities are caught before merge, not after breach.
• AI & Agentic Defense: Proactively identify and build AI/LLM-driven agents that close the gap between exposure and detection. CVE feeds alone are a shrinking signal in an AI-accelerated threat landscape, so we need LLM inference layered at multiple points in the platform: dependency and supply-chain analysis, code-level review, and runtime behavior, catching what a CVE number never will.
• Deep Investigation: Own security incidents end-to-end, from the first anomalous signal, through root-cause analysis and remediation, to the post-mortem that prevents recurrence. You follow a problem to completion; you don't hand it off halfway through.
• Read by Code: Read code fluently enough to validate a finding at the source rather than taking a scanner's word for it. You won't be writing production code daily, but you need to be comfortable in at least one systems language (C, C++, Rust, or similar languages) well enough that reading it critically, and catching what's wrong with it, is second nature.
• Vulnerability & Threat Management: Lead vulnerability management and threat modeling across our entire environment, internal and external, prioritizing based on real-world exploitability and business impact, not just CVSS score.
• Compliance & Trust: Partner with legal, IT, and leadership to maintain and mature our compliance posture (SOC 2 Type II, ISO 27001, InfoSec, and customer security questionnaires), translating audit and control requirements into practical engineering work rather than checkbox paperwork.
• Mentorship & Influence: Act as a force multiplier by mentoring engineers and influencing cross-functional product teams on secure coding, threat modeling, and security-first development.
• Incident Response: Serve as a high-level escalation point for complex security incidents, conducting deep-dive post-mortems that drive structural improvements rather than quick fixes.

What You’ll Do

• A Student of the Craft: You're less interested in being the smartest person in the room than in staying honest about how fast the room is changing. AI has rewritten the security landscape almost overnight, and some of the assumptions and playbooks that worked two years ago no longer hold. You know your way around Arxiv and ACM, and keep a genuine eye on the research as it's published, not just the vendor’s take on it three months later. You track where the industry is headed, not just where it's been, and you're comfortable saying "that doesn't work anymore" and rebuilding the approach.
• Secure by Design: You have hands‑on experience with secrets management (Vault, AWS KMS/Secrets Manager, or similar), secure API design (authN/authZ, input validation, rate limiting), and system hardening standards like CIS Benchmarks and SELinux/AppArmor.
• The "AI Native" Defender Mindset: You are passionate about the intersection of security and AI, and you think beyond CVE feeds, you want LLM inference embedded at multiple layers of the platform (supply chain, code, runtime) doing the correlation and triage a human can't keep pace with alone. To you, an LLM is nothing more than a non-deterministic program, and you can tell the difference between a genuine threat and hype.
• Proven Track Record: You have 8+ years of experience in Security Engineering, AppSec, Vulnerability Research, or Incident Response, with at least 2 years in a Senior-level capacity driving cross-team initiatives.
• Foundational & Polyglot: You can write in a systems-level language, such as C, C++, Rust, Go, or ASM, not because you'll ship production code daily, but because writing it is what makes reading it, and anything else in the stack (Ruby, Node.js, Java, Typescript, Python), critically possible. If the moment ever calls for it, you can pop open a shared object in a disassembler and figure out what is actually happening.
• Investigator's Mindset: You are a relentless, curious investigator who follows a problem from initial exposure to root cause to full closure, paired with a genuine hunger to learn that keeps you ahead of new attack techniques and defensive tooling. You respond in measured steps, not everything is a crisis, and you understand that "don't panic" is a discipline, not just a slogan.
• Compliance Fluency: You're comfortable operating within SOC 2, ISO 27001, or similar compliance frameworks, and know how to satisfy an audit's control requirements without over-engineering the underlying system.
• Autonomous Operator: You take direction from your team lead on priorities, but how you plan and execute against those priorities, and how you go about securing the environment day to day, is up to you. If you spot a gap, something that needs doing and isn't on the agenda, you don't wait for it to be assigned, you raise it and work with your lead to get it prioritized.

What VTS Values & How We Show It

• Strive for Excellence- We know your potential is unlimited. Take advantage of our executive coaches and our training and career development programs available to all employees!
• Be Customer Obsessed - We’re employee obsessed too! VTS offers competitive compensation, comprehensive health benefits (including dental and vision), pre‑tax commuter benefits, and a 401(k) plan. Not to mention the fun stuff - quarterly happy hours, wellness events, clubs, and team lunches!
• Be Curious- Benefit from a culture that promotes new learning. VTS offers an education stipend to all employees!
• Move as One- We work in an open floor plan to promote cross-functional collaboration.
• Take Ownership- Be an owner of the company you’re building with our equity packages.
• Appreciate the Difference- VTS embraces and celebrates diversity. We understand the importance of a strong work‑life balance. We offer a flexible PTO policy, generous family leave program, and more!

ABOUT VTS

VTS is the only AI-driven technology platform enabling intelligent real estate by unifying industry professionals, investors, and their customers at scale. In 2013, VTS revolutionized commercial real estate leasing operations with what is now VTS Lease. Today, VTS AI is the largest first-party insights and collaboration engine in the industry, transforming how strategic decisions are made and executed by the real estate industry globally. With the VTS Platform, consisting of VTS Lease , VTS Market , VTS Activate , and VTS Data , every stakeholder in real estate is given real‑time market information and workflow tools to do their job with unparalleled speed and intelligence. VTS is the global leader, with more than 60% of Class A office space in the U.S., and 13 billion square feet of office, residential, retail, and industrial space is managed through the platform worldwide. VTS is utilized by over 45,000 professionals and over 1.2 million total users each day, including industry‑leading customers such as Blackstone, Brookfield Properties, LaSalle Investment Management, Hines, BXP, Oxford Properties, JLL, and CBRE. VTS maintains offices in New York City, London, Toronto, Chicago.

Pay Transparency

At VTS, we pride ourselves on articulating a clear and transparent philosophy around equitable, impartial compensation that will allow us to recruit and retain an exceptional team. The base salary is market-driven at the time of offer and is based on tier 1 market data. The salary for this role will range between $160,000 and $200,000 and is determined by several factors, including your skills, prior relevant experience, quality of interviews, leveling, and geography.

EEO Guidelines

VTS embraces diversity and equal opportunity in a serious way. We are committed to building a team that represents a variety of backgrounds, perspectives, and skills. The more inclusive we are, the better our work will be.

All your information will be kept confidential according to EEO guidelines. For more information about what we collect and how we use it, please refer to the Candidate Privacy Statement.

If you have a disability or special need that requires accommodation at any time during the recruitment process, please letus know at [e-mail]

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self‑identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in VTS’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service‑connected disability.

A "recently separated veteran" means any veteran during the three‑year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.