Senior / Staff Security Engineer

Jobgether; United States; Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Remote-first

Equity

Health coverage

Paid time off

Flexible workspace

Job summary

Jobgether is seeking a Senior/Staff Security Engineer in the United States for a remote-first role. You will own vulnerability management, incident response, and cloud security across GCP, Kubernetes, and PostgreSQL, while guiding security at scale with AI-assisted tooling.

You’ll work with engineering, Trust, and GRC teams to drive actionable risk reductions, automate security processes, and ensure robust security postures across the product and infrastructure.

Qualifications

• Five+ years of experience in security engineering with hands-on work in vulnerability management, product/app security, incident response or cloud security.
• Ability to read and reason about code, especially TypeScript or similar languages.
• Experience with cloud environments; familiarity with GCP is a plus.
• Strong incident management and risk-based decision-making skills.
• Comfort with AI-assisted coding and security tools and responsible use.

Responsibilities

• Own vulnerability management lifecycle, triage, prioritize, and remediate findings across product, infra, and dependencies.
• Maintain SLAs for vulnerability remediation and drive risk reduction.
• Lead bug bounty intake, validate severity, coordinate fixes with engineering, and coordinate with researchers.
• Lead product security assessments: threat modeling, code review, manual and tool-based testing.
• Evaluate security risks from AI-powered features and agent-facing capabilities.
• Serve as primary incident responder, coordinate containment, recovery, and post-incident reviews.
• Strengthen cloud/infrastructure security on GCP, Kubernetes, PostgreSQL; harden configs and defaults.
• Address security gaps from audits and automated scans with infra/engineering teams.
• Build and maintain security tooling, detections, and automation for efficiency and scale.
• Leverage AI/LLM tools to accelerate triage and code Review while maintaining oversight.
• Collaborate with GRC/Trust teams to document risks and align controls with practices.
• Communicate findings clearly to technical and non-technical stakeholders.
• Set priorities, make risk-based decisions, and escalate when needed.

Job description

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior / Staff Security Engineer based in United States .

The Senior / Staff Security Engineer will play a key role in strengthening product and infrastructure security for a rapidly evolving software platform serving teams worldwide. In this hands‑on position, you will help shape and scale security practices as the product expands its capabilities and enterprise presence. You will own critical security initiatives spanning vulnerability management, application security, incident response, and cloud infrastructure protection. Working closely with engineering and trust teams, you will integrate security into product development, improve detection and remediation processes, and build automation that scales with the business. This remote‑first opportunity offers significant autonomy, technical ownership, and the chance to influence security strategy while working with modern cloud technologies and AI‑assisted engineering tools.

Accountabilities

• Own and continuously improve the vulnerability management lifecycle, including identifying, triaging, prioritizing, and remediating vulnerabilities across the product, infrastructure, and software dependencies.
• Maintain effective vulnerability remediation service-level agreements (SLAs), ensuring security findings translate into meaningful risk reduction.
• Manage the bug bounty program by reviewing incoming reports, validating severity, coordinating fixes with engineering teams, and maintaining professional relationships with security researchers.
• Lead product security assessments, including threat modeling new features, reviewing architecture and code, and conducting hands‑on manual and tool-assisted testing.
• Evaluate emerging security risks associated with AI‑powered features and agent‑facing product capabilities.
• Serve as a primary incident responder, leading investigations, coordinating containment and recovery, facilitating post‑incident reviews, and translating lessons learned into concrete security improvements.
• Strengthen cloud and infrastructure security across Google Cloud Platform (GCP), Kubernetes, PostgreSQL, and related services by hardening configurations and implementing secure defaults.
• Address security gaps identified through audits, automated scanning, and internal assessments in collaboration with infrastructure and engineering teams.
• Build and maintain security tooling, detections, scripts, and automation to improve operational efficiency and scale security processes.
• Leverage AI and large language model (LLM) tools to accelerate vulnerability triage, code review, and repetitive investigative tasks while maintaining appropriate technical oversight.
• Partner with Governance, Risk, and Compliance (GRC) and Trust teams to document risks, maintain risk registers, collect control evidence, and align compliance requirements with actual engineering practices.
• Communicate technical findings, risks, and remediation recommendations clearly to technical and non‑technical stakeholders.
• Establish priorities independently, make pragmatic risk‑based decisions, and elevate critical issues when necessary.

Requirements

• At least five years of experience in security engineering, with substantial hands‑on expertise in at least two of the following areas: vulnerability management, product or application security testing, incident response, and cloud security.
• Broad security engineering knowledge and the ability to work across multiple domains rather than focusing exclusively on a single specialization.
• Strong technical skills, including the ability to read, understand, and reason about application code, particularly TypeScript or comparable programming languages.
• Practical experience working in cloud environments; familiarity with Google Cloud Platform (GCP) is an advantage.
• Demonstrated ability to investigate security findings in depth, identify root causes, and work directly toward effective remediation rather than simply reporting issues.
• Experience with vulnerability assessment, threat modeling, security testing, incident investigation, or infrastructure hardening.
• Familiarity with AI‑assisted coding and security tools, such as Claude, Codex, or comparable solutions, and the ability to use them responsibly to improve productivity.
• Strong incident management skills, including the ability to remain composed under pressure, lead investigations independently, and coordinate post‑incident reviews.
• A builder mindset, with a preference for developing scripts, tools, detections, and automation to eliminate repetitive manual work.
• A pragmatic, risk‑focused approach that prioritizes measurable security improvements over compliance checklists or raw finding counts.
• Strong ownership and prioritization skills, with the ability to work independently, navigate ambiguity, and recognize when escalation is necessary.
• Excellent written and verbal communication skills, including the ability to explain complex technical risks clearly and provide actionable recommendations.
• Ability to collaborate effectively with product, infrastructure, engineering, and compliance stakeholders in a distributed, remote‑first environment.
• Familiarity with security and collaboration tools such as GitHub Advanced Security, RunReveal, SentinelOne, Vanta, GitHub, and Slack is beneficial.

Benefits

• Competitive compensation: Salary and equity opportunities; a specific salary range for Canada was not provided.
• Equity benefits: Employee-friendly equity terms, including early exercise options in the United States and extended exercise windows.
• Remote‑first work: Work remotely without a required daily commute.
• Flexible workspace: Paid coworking space or desk.
• Health coverage: Coverage provided according to applicable country requirements.
• Paid time off: Five weeks of paid vacation annually, in addition to local statutory holidays.
• Parental leave: Four months of paid parental leave.
• Extended time off: A paid month off after four years of service and every two years thereafter.
• Daily meal and coffee stipend for every workday.
• Team connection: Regular team events and off‑sites.
• Work environment: A focused, collaborative team culture that values technical excellence, autonomy, and thoughtful execution.

We appreciate your interest and wish you the best!

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre‑contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.