Staff Security Engineer
Rox
Get a reply from this employer
Your resume and cover letter, tailored to exactly what they’re hiring for.
Benefits offered by this job
Job summary
Rox is seeking a Staff Security Engineer in San Francisco to own end-to-end security across product, cloud, and enterprise customer work. You will hunt anti-patterns, fix issues in code, and explain risk to engineers and executives. You will partner across platform teams and GTM to secure enterprise deals.
You will report to the VP of Engineering and participate in an on-call rotation, with a strong focus on secure design and customer trust.
Qualifications
- 10+ years in security engineering, application security, or infrastructure engineering with senior scope.
- Strong software engineering skills; you read and write production code (Python, TypeScript) and ship fixes.
- Deep experience securing AWS or another major cloud (IAM, KMS, networking, containers).
- Hands-on application security: threat modeling, secure code review, OWASP Top 10, multi-tenant data isolation.
- Security depth across tools and vendors; broad systems fundamentals.
- Experience running vulnerability management, detection, and incident response in production.
- Comfort working with enterprise customers on security reviews and architecture discussions.
- Ability to explain risk tradeoffs clearly; be judgmental about risk.
Responsibilities
- Own Rox’s security program and roadmap; set security standards as we scale.
- Run and tune security tooling across CI, runtime, and testing; triage findings.
- Review designs and code for new features; build guardrails for secure shipping by default.
- Secure tenant isolation, AuthN/AuthZ, and RBAC across runtime and public APIs.
- Harden cloud footprint: IAM, secrets, network segmentation, encryption, logging.
- Secure our software supply chain and respond to vulnerabilities and package issues.
- Design security architecture for enterprise deployment, including customer clouds.
- Lead security reviews with customers; participate in enterprise security calls.
- Collaborate with Compliance on audits and trust materials.
- Build and run incident response; create playbooks and postmortems.
- Participate in on-call rotations; security is 24/7.
- Monitor threat landscape and translate incidents into action for Rox.
Skills
Tools
Job description
At Rox, we believe in empowering people to do their best work.
Our platform supercharges sellers with autonomous revenue agents to do the manual work so they can focus on what they do best: selling. Just as coding agents 10x’d engineering, revenue agents 10x customer work.
We are reimagining the revenue stack by building the world’s first revenue operating system, from the application layer to the system of context. With Rox, humans are evolving to orchestrators while agents manage the end-to-end customer lifecycle.
Rox powers Global 2000 leaders in banking, hardware, construction, and sovereign AI, while serving dominant AI winners like Ramp and Cognition.
Underlying all of this success is an unwavering, shared belief in the mission, with an unreasonable commitment of doing whatever it takes to make it a reality.
Nothing is possible without the world-class team, assembled to redefine how businesses operate.
Members on our team have:
Founded and exited successful companies
Held the highest positions at Google, AWS, Confluent, and New Relic
Won IMO and IOI gold medals
Published field-defining papers
We’re backed by the best, including Sequoia, General Catalyst, Google Ventures, Elad Gil, and Chris Ré.
No matter how small, we strive to make sure every detail is right. We care deeply about every interaction, both in terms of whether it helps the seller get the job done, but also how the product makes them feel. We get a visceral feeling when something is off and stop at nothing to make sure we make it right. We never settle, continuously exploring ways to delight sellers.
In all aspects of our craft, we commit. We not only are immediately reactive to customers’ requests but are proactive about driving value even before they ask. We are also obsessive about always learning and honing our craft, improving ourselves and product every single day.
Talking is easy but the difference comes from the execution. We lean heavily towards making thoughtful yet fast decisions and delivering immediately. We play in a field where trust is paramount. We earn the trust and right to empower the best sellers by forging a history of over-delivering on the promise at record speed.
Rox agents read and act on our customers’ most sensitive revenue data. Security is a core part of how we win and keep enterprise trust.
As a Staff Security Engineer, you will own security end to end across product and application security, cloud and infrastructure security, and the security side of enterprise customer work. You will be one of our strongest engineers: someone who hunts down engineering anti-patterns, fixes them in code, and explains the “so what” of security risk to engineers, executives, and customers.
You will report to the VP of Engineering for starters, and work closely with Platform, Foundations, Forward Deployed Engineering, and our GTM team on enterprise deals.
Own Rox’s security program and roadmap, and set the bar for secure engineering as we scale.
Run and tune security tooling across CI, runtime, and testing. Triage findings and drive fixes to closure.
Review designs and code for new features, agent capabilities, integrations, and public APIs. Build guardrails and paved roads so engineers ship securely by default.
Secure tenant isolation, AuthN, AuthZ, and RBAC across our agent runtime and customer-facing APIs.
Harden our cloud footprint: IAM, secrets, network segmentation, encryption at rest and in transit, logging, and detection.
Secure our software supply chain, and respond fast to newly disclosed vulnerabilities and compromised packages.
Design the security architecture for enterprise deployment models, including customer-managed keys, security log export, single tenant, and deployments in customer clouds.
Be the security voice with customers: lead security reviews and join calls with enterprise security teams.
Partner with Compliance on audits, questionnaires, and trust materials. Security and compliance are different jobs, and you bring the security depth.
Build and run incident response: playbooks, postmortems, and customer communication.
Take part in an on-call rotation for security incidents. Security is 24/7, and we want to be upfront about that.
Monitor the threat landscape and turn industry incidents into concrete actions for Rox.
10+ years in security engineering, application security, or infrastructure engineering with a strong security focus, including time operating at Staff level scope.
Strong software engineering skills. You read and write production code (Python, TypeScript, or similar) and ship fixes yourself.
Deep experience securing AWS or another major cloud: IAM, KMS, networking, containers, and infrastructure as code.
Hands-on application security experience: threat modeling, secure code review, OWASP Top 10, AuthN and AuthZ, and multi-tenant data isolation.
Depth in security and systems fundamentals that carries across any tool or vendor.
Experience running vulnerability management, detection, and incident response in production.
Comfort working directly with enterprise customers on security reviews and architecture discussions.
Good judgment about risk. You know when to block and when to unblock, and you explain tradeoffs clearly.
Be located in or willing to relocate to San Francisco. This role is onsite at our SF HQ.
Supported a SOC 2 Type II, ISO 27001, or similar audit alongside a compliance team.
Built customer-managed key systems, security log integrations, or single tenant deployment models.
Experience securing LLM and agent systems: prompt injection, tool and data access controls, and secure handling of customer data in AI pipelines.
Offensive security or penetration testing background.
Competitive pay with considerable equity upside
Medical, dental, and vision, including 100% company-paid plans for you and eligible dependents
Company-paid life & AD&D, plus short- and long-term disability
401(k) with automatic enrollment
Unlimited PTO, plus paid sick leave, company holidays, and bereavement
Up to 20 weeks of paid parental leave at 100% pay (birth, adoption, or foster)
Wellness stipend: $375/quarter
Learning stipend: up to $2,000/year
Internet & cell phone stipend: $25/month
Mental health support, virtual care, and care navigation
Fertility & family-building support, plus backup care membership
Pre-tax commuter benefits (transit & parking)
SF HQ: daily catered breakfast & lunch, meal allowances, and rideshare support when commuting to the office
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
