Staff Security Engineer

eightsleep; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Equity

Flexible paid time off

Health insurance

Vision and dental coverage

Parental leave

Commuter benefits

Job summary

Eight Sleep is seeking an energetic security generalist to own and improve security across cloud infrastructure, software, connected devices, corporate IT, identity, and AI use. This hands-on role centers on building a risk-based vulnerability program, automating repeatable security work, and partnering with engineering, research, clinical, and security leaders to make risks understandable and actionable.

The role requires practical experience automating security processes, clear technical

Qualifications

• Hands-on security leader with ownership of security across multiple environments.
• Ability to assess risk using exploitability and data sensitivity beyond scores.
• Experience automating security workflows and remediation processes.
• Clear writing and communication for engineers, auditors, and executives.

Responsibilities

• Run vulnerability management across cloud, containers, dependencies, devices and products.
• Set remediation targets and automate assignment, tracking and reporting.
• Manage software supply chain safeguards, including SBOM and CI/CD controls.
• Coordinate vulnerability intake, testing and patch rollout with hardware teams.
• Scope and manage penetration tests or bug bounty programs, with remediation triage.
• Support identity and device security, compliance controls, and safe AI adoption.

Skills

Vulnerability management

Automation of security processes

Cross-functional collaboration

Security across cloud and devices

Technical writing

Tools

CI/CD security

SBOM tooling

Vulnerability scanners

Job description

Role overview

Own and improve security across cloud infrastructure, software, connected devices, corporate IT, identity, and AI use. This hands-on generalist role centers on building a risk-based vulnerability program, automating repeatable security work, and partnering with engineering, research, clinical, and security leaders to make risks understandable and actionable.

Responsibilities

• Run vulnerability management across cloud systems, containers, dependencies, employee devices, and connected products; prioritize findings by exploitability and business impact.
• Set remediation targets and automate assignment, tracking, escalation, and reporting through to verified fixes.
• Manage software supply chain safeguards, including dependency risk, software bills of materials, container hygiene, and CI/CD controls.
• Coordinate product vulnerability intake, disclosure, testing, and patch rollout with firmware and hardware teams.
• Scope and manage penetration tests or a bug bounty program, including triage and confirmation of remediation.
• Support corporate identity and device security, compliance controls, and safe adoption of AI tools.

Requirements

• Experienced security practitioner, ideally with prior ownership of security across a small team or broad environment.
• Able to assess vulnerability risk using exploitability, reachability, exposure, and data sensitivity rather than relying on severity scores alone.
• Practical experience automating security processes and carrying findings through remediation.
• Clear technical writing and communication for engineers, auditors, and executives.
• Comfortable working across cloud, enterprise, software, and connected-device security with a range of technical teams.

Nice to have

Experience with SOC 2, ISO 27001, or HIPAA audits; work in regulated or health-adjacent settings; and incident response beyond tabletop exercises.

Benefits and work setup

The listing describes substantial day‑one ownership, equity participation, flexible paid time off, health, vision, and dental coverage, paid parental leave, and commuter benefits. Benefit availability may vary by location.