Staff Security Engineer

lennar; United States; On-site; USD 180,000 - 240,000; Full time

Job summary

Lennar is seeking a Staff Security Engineer to own and drive security capabilities across cloud, network, data, and endpoint domains. You will lead engineering direction, guardrails, and hands-on cloud security for IaaS, PaaS, and SaaS environments in a senior technical ownership role.

You will mentor engineers, collaborate with architecture and development teams, and guide cross-domain security controls while aligning with legal and risk requirements.

Qualifications

• Experience leading security domains across cloud, network, data, endpoint, and application security.
• Strong ability to set engineering standards for security product design and deployment.
• Mentorship of junior and senior security engineers across multiple teams.
• Ability to review and approve architecture and configuration changes in security products.
• Experience with CSPM, CNAPP, CASB, SSE, and cloud workload protection.

Responsibilities

• Own the technical direction of security domains including cloud, network, data, endpoint, WAF, app security, SIEM, and posture management.
• Lead design, deployment, and documentation standards for security products.
• Mentor engineers and drive depth across domains.
• Collaborate with Enterprise Architecture and leadership to defend the team's position.
• Lead vendor evaluations, risk assessments, and procurement support.

Job description

Summary of Position: The Staff Security Engineer is the senior technical owner of the security capabilities the Enterprise Security Office runs: network security, data security, endpoint security, edge and web application protection, application security, security operations and SIEM, and vulnerability and posture management. The role sets engineering direction across all of these domains and keeps hands‑on ownership of cloud security for IaaS, PaaS, and SaaS environments.

Summary of Position: The Staff Security Engineer is the senior technical owner of the security capabilities the Enterprise Security Office runs: network security, data security, endpoint security, edge and web application protection, application security, security operations and SIEM, and vulnerability and posture management. The role sets engineering direction across all of these domains and keeps hands‑on ownership of cloud security for IaaS, PaaS, and SaaS environments.

This is an individual contributor role with technical leadership responsibility and no direct reports. The Staff Security Engineer works with security engineers, architects, infrastructure teams, and application development teams so that controls in every domain are designed, deployed, and configured correctly, and mentors senior and junior engineers on the team.

Principal Duties and Responsibilities:

Technical Leadership Across Domains:

• Own the technical direction of the team's security domains: cloud security, network security, data security, endpoint security, edge and web application firewall, application security, security operations and SIEM, and vulnerability and posture management.
• Set the engineering standard for how products in each domain are designed, deployed, documented, and reviewed, including the design, decision, and change records the team keeps for every product it runs.
• Review and approve significant architecture and configuration changes to security products in any domain.
• Act as the escalation point for the team's hardest technical problems, including issues that cross more than one domain or more than one engineering team.
• Mentor senior and junior security engineers and security operations staff, and build depth in domains where only one engineer currently has it.
• State and defend the team's technical position with Enterprise Architecture, Infrastructure, application teams, and leadership.

Domain Engineering and Operations:

Cloud Security:

Own the cloud security strategy and its implementation across public cloud (IaaS, PaaS) and SaaS platforms, and lead the design, implementation, and management of:

• Core controls for IaaS, PaaS, and SaaS services, including identity, network segmentation, logging, and key and secret management
• Cloud Security Posture Management (CSPM)
• Cloud-Native Application Protection Platforms (CNAPP)
• Cloud Access Security Broker (CASB) and Security Service Edge (SSE)
• Cloud workload, container, and Kubernetes protection

Network Security:

Guide the design and operation of next-generation firewalls, remote access VPN, and cloud-native firewall controls covering traffic entering and leaving the network.

Data Security:

Guide the controls that prevent data loss through browsers, email, and removable media, including enterprise browser isolation, email security, and data classification and labeling.

Endpoint Security:

Guide endpoint detection and response, application control, and server protection across laptops, desktops, and servers.

Edge and WAF:

Guide web application firewall coverage and rule tuning for public-facing applications, including false-positive reduction with application owners.

Application Security:

Guide static and dynamic testing, dependency and secret scanning, and pipeline controls for cloud-native development and delivery platforms (DevOps, CI/CD), with remediation workflows run alongside development teams before and after code ships.

Security Operations and SIEM:

Contribute detection logic, log source onboarding, and automated response playbooks, support triage of complex or cross-domain alerts, and make sure cloud telemetry reaches the SIEM in a usable form.

Vulnerability and Posture Management:

Guide vulnerability scanning and posture assessment across endpoints, servers, and cloud, and drive prioritized remediation with infrastructure and application owners.

Program and Cross-Team Responsibilities:

Contribute to the Cybersecurity Program and to the Security Engineering and Architecture roadmaps.

Meet legal, compliance, and regulatory requirements that apply to security controls in any domain, including cloud.

Provide input to Lennar's Risk Management, Compliance, and Incident Response teams for every domain the team owns.

Lead vendor and product evaluations, including requirements definition, proof of concept, risk assessment, procurement support, and selection recommendations.

Evaluate new and emerging services and technologies and recommend where they fit the existing control set.

Drive remediation