Senior Security Engineer - SOC 2, SaaS, Remote

Riivet; Washington (Washington County); Hybrid; USD 150,000 - 230,000; Full time

Benefits offered by this job

Meaningful equity

Health, dental, and vision coverage

Budget for certifications, training, &

Job summary

Riivet is seeking a senior security engineer to become the first dedicated security hire, owning strategy and delivery for product hardening, data protection, and compliance. You will shape SOC 2 Type II readiness, manage audits and pentest coordination, and embed security across the development lifecycle.

You’ll protect a Next.js web app, Cloudflare Workers, and mobile clients, working with engineers, auditors, and customers on security questionnaires and vendor reviews.

Qualifications

• 7+ years in security engineering with depth in application and cloud security.
• Hands-on coding ability; able to read TypeScript and contribute PRs.
• Experience delivering SOC 2 Type II or ISO 27001 for a SaaS product.
• Knowledge of Postgres RLS, JWT-based auth, and multi-tenant SaaS pitfalls.
• Proven track record running a pentest program end-to-end.
• Strong written communication capable of explaining threats to engineers and buyers.

Responsibilities

• Own application and product security across Next.js app, Cloudflare Worker, and mobile clients.
• Harden Supabase and Postgres layer with RLS, isolation, secrets hygiene.
• Run and respond to pentests, bug bounties, and vulnerability scans; drive remediation.
• Own SOC 2 Type II readiness: controls, evidence, auditor coordination.
• Lead threat modeling and integrate security into development lifecycle.
• Own incident response: on-call rotation, playbooks, post-mortems, and customer communication.
• Handle inbound security questionnaires and procurement reviews.
• Set and enforce secrets rotation, access control, and vendor security cadence.

Skills

Application security

Cloud security

Security engineering

Coding in TypeScript

SOC 2 Type II readiness

Tools

PostgreSQL

RLS

JWT

Supabase

Cloudflare Workers

Job description

Riivet is seeking a senior security engineer to become the first dedicated security hire, owning strategy and delivery for product hardening, data protection, and compliance. You will shape SOC 2 Type II readiness, manage audits and pentest coordination, and embed security across the development lifecycle.

You’ll protect a Next.js web app, Cloudflare Workers, and mobile clients, working with engineers, auditors, and customers on security questionnaires and vendor reviews.