Senior / Staff Security Engineer

Linear; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Linear is seeking a senior security engineer to own hands-on security across product and infrastructure. You’ll manage vulnerability programs, lead incident response, and contribute to secure by default cloud configurations on GCP/k8s with Postgres.

You’ll collaborate across teams, use AI tooling to speed triage, and help scale security without growing headcount. Ideal candidates have 5+ years in security engineering, strong code literacy (TypeScript), and experience in cloud environments.

Qualifications

• 5+ years in security engineering with breadth across multiple areas.
• Hands-on, technical, able to read code (TypeScript) and review designs.
• Experience in cloud environments and incident response.

Responsibilities

• Operate and improve vulnerability management end-to-end with meaningful SLAs.
• Lead product security testing, threat modeling, and code reviews.
• Be primary responder for security incidents and postmortems.
• Own cloud/infra security posture on GCP/k8s with secure defaults.
• Build security tooling and automate recurring tasks using AI tooling.
• Collaborate with GRC/Trust to reflect findings in risk registers.

Skills

Security engineering

Vulnerability management

AppSec testing

Incident response

Cloud security

TypeScript

Tools

GCP

Kubernetes

Job description

At Linear, we're building the product development system for teams and agents. AI is fundamentally changing how software gets built, and we're shaping the tools this new era requires.

Founded in 2019, Linear has become the platform of choice for more than 30,000 companies (including OpenAI, Coinbase, and Ramp) to plan, build, and ship their products. Today, our team is distributed across North America, Europe, and Australia, and we're continuing to grow internationally. What unites us is relentless focus, fast execution, and a deep care for software craftsmanship.

At Linear, we are committed to quality. Security is an essential part of that quality - not a layer that we add later, but something we build in from the start. We have a foundational security program we're proud of but, as Linear evolves our product and scales into enterprise, there's meaningful work ahead: staying ahead of vulnerabilities as our attack surface grows, responding fast and cleanly when incidents happen, and hardening our product and infrastructure. As Security Engineer at Linear, you'll be operating in a high-autonomy role with real scope, doing hands-on security work across the product and infrastructure we build.

Location & work mode

Linear is a remote-first company. This role is open to candidates based in North America. You can work from anywhere within this region. We value deep focus and async collaboration, with intentional moments to connect in person through team off-sites, optional co-working, and occasional travel.

What you'll do

Depending on your experience / skillset and our broader priorities, you could:

• Operate, automate, and extend vulnerability management end-to-end: triage, prioritize, and drive remediation across product, infrastructure, and dependencies, and keep the program’s SLAs meaningful rather than theoretical

• Run our bug bounty program: triage incoming reports, validate severity, work with engineering on fixes, and keep researcher relationships professional and responsive

• Lead product security testing: threat model new features (including AI/agent-facing surfaces), review designs and code for security-relevant risk, and do hands-on testing (manual and tool-assisted) rather than relying solely on scanners

• Be a primary responder for security incidents: lead investigation and containment, drive postmortems, and turn lessons into concrete hardening work

• Own meaningful chunks of our cloud/infra security posture on GCP/k8s/Postgres: harden configurations, close gaps surfaced by audits or scanning, and partner with infra engineering on secure defaults

• Build and maintain security tooling and automation, including using AI/LLM tooling to speed up triage, code review, and repetitive investigation work, so the program scales without linear headcount growth

• Partner with the GRC/Trust function: feed real findings into the risk register and control evidence, and help make sure compliance requirements reflect actual engineering practice

What we're looking for

• A generalist, senior-level security engineer (5+ years across security engineering, with real depth in at least two of: vulnerability management, product/appsec testing, incident response, and cloud security). We need breadth, rather than a narrow specialist in any one of these.

• Hands-on and technical: you can read and reason about code (we use a lot of TypeScript), you're comfortable in cloud environments (GCP a plus), and you can go deep on a finding rather than just filing a ticket for someone else to fix. You're comfortable using AI coding/security tools as force multipliers (Linear Agent, Claude, Codex, etc).

• Calm under pressure: you can lead an incident from first alert through postmortem without needing to be told what to do next