Staff Security Engineer

Root Inc.; United States; Remote; USD 157,000 - 196,000; Full time

Job summary

Root Inc. is seeking a Staff Security Engineer to drive security strategy across the enterprise and bridge business risk with execution. You will define paved roads for security, secure AI adoption, and elevate our maturity to meet regulatory demands.

You will embed security in the development lifecycle, build guardrails, and measure risk reduction. You will own the security tooling stack and participate in on-call rotations, partnering with product and engineering leaders across the company.

Qualifications

• 10+ years of security experience spanning security operations, product security, infrastructure security, and application security.
• You have set architectural direction with roadmaps, standards, and secure reference patterns.
• You have partnered with product and engineering to embed security into the development lifecycle.
• Deep technical breadth across cloud (AWS) and enterprise security; hands-on with PoCs.
• You have run security metrics programs, driving prioritization and impact.
• You design systems to meet best practices and regulatory requirements.
• You have secured AI systems hands-on, from threat modeling to runtime defense.
• You communicate with non-security stakeholders, automate recurring problems.
• Bonus: offensive security experience and AI attack knowledge.

Responsibilities

• Define architectural standards that protect employees, customers, and core systems across cloud and applications.
• Embed security in the development lifecycle with threat modeling and design reviews.
• Build guardrails and CI checks to make secure paths easy.
• Develop metrics and scorecards showing risk reduction and align security spend to priorities.
• Secure AI adoption with architectures, threat models, and runtime protections.
• Explain security practices to engineers and help teams through design reviews.
• Own the security tooling stack and manage build-versus-buy decisions.
• Participate in on-call rotations for the security engineering team.

Skills

Security operations

Product security

Infrastructure security

Application security

Education

CS/Cybersecurity degree

Job description

Root is on a mission to unbreak insurance by creating experiences people love at prices they can't believe. We believe that investing in world-class technology will facilitate a new class of insurance products, driving a massive positive impact on the hundreds of millions of drivers who carry auto insurance in the US. Root's Engineering team is committed to building a flexible platform on which our product designers and quantitative scientists can quickly test ideas, deploy them into production, and iterate, with the ultimate objective of a delightful customer experience coupled with effective risk management.

The Opportunity

At Root, we are reimagining insurance by building a smarter, more equitable system from the ground up. As the Staff Security Engineer, you will be the technical visionary driving security strategy across our entire enterprise. You will act as a force multiplier for the Information Security and IT organizations, bridging the gap between high-level business risk and operational execution. In this role, you will define the "paved roads" for security, securing our AI adoption, and elevating our technical maturity to meet the evolving demands of our insurance business and regulatory landscape.

Salary Range

$157,000 - $196,000 (Eligible for competitive bonus and equity offering)

Root is a "work where it works best" company. This means we will support you working in whatever location that works best for you across the US.

How You Will Make An Impact

• Define the architectural standards that protect our employees, customers, and core systems, covering both our cloud environment and our applications, so security is the default state rather than a review at the end.
• Embed security in the development lifecycle: threat-model new product features, review designs before code ships, and build guardrails like secure libraries and CI checks that make the safe path the easy path.
• Decide what good looks like and prove it. Build the metrics and scorecards that show leadership how much risk we removed, and tie security spend to the risks and compliance obligations that matter most.
• Secure our adoption of AI: architectures, threat models, and runtime protections for AI systems in production. Then point the same technology back at our own work, automating vulnerability management, threat detection, and security operations.
• Be the engineer others bring their hard problems to. Explain the why behind a security practice, not just the requirement, and help engineers across the department level up through design reviews and pair sessions.
• Own the security tooling stack, including the build-versus-buy calls, so our controls earn their cost, scale with the company, and satisfy our requirements.
• Take a regular turn in the security engineering team's on-call rotation.

What You Will Need To Succeed

• 10+ years of security experience spanning security operations, product security, infrastructure security, and application security.
• You have set architectural direction: roadmaps, standards, and secure reference patterns that more than one business unit actually followed.
• You have partnered with product and engineering leaders to build security into the development lifecycle, through threat modeling, design review, and secure defaults, instead of bolting it on afterward.
• Deep technical breadth across cloud (AWS) and traditional enterprise security. This is a hands-on role: you build proof-of-concepts to prove a design, and you dig into broken systems yourself when it matters.
• You have run security metrics programs, and the numbers drove prioritization and impact.
• You have designed systems against best practices and regulatory requirements and you know how to pass an audit by design rather than by scrambling before it.
• You have secured AI systems hands-on, from threat modeling to runtime defense, and you have used AI to automate real security work.
• You talk to non-security stakeholders in plain language, build consensus, and influence engineering leadership without being the department of no. You would rather automate a recurring problem than file a ticket about it.
• Bachelor's or Master's in Computer Science, Cybersecurity, or a related technical field, or equivalent practical experience. CISSP is a plus.
• Bonus points for offensive security experience: penetration testing, red teaming, or exploit development. You know how attacks work because you have run them. Extra if that includes attacking AI systems.

As part of Root's interview process, we kindly ask that all candidates be on camera for virtual interviews. This helps us create a more personal and engaging experience for both you and our interviewers. Being on camera is a standard requirement for our process and part of how we assess fit and communication style, so we do require it to move forward with any applicant's candidacy. If you have any concerns, feel free to let us know once you are contacted. We're happy to talk it through.

Please see our Privacy Notice available HERE for more information on how we process your personal data.

Consistent with the Americans with Disabilities Act (ADA) and the Civil Rights Act of 1964, it is the policy of Root to provide reasonable accommodation when requested by a qualified applicant or candidate with a disability, unless such accommodation would cause an undue hardship for Root. The policy regarding requests for reasonable accommodation applies to all aspects of the hiring process. If reasonable accommodation is needed, please contact [e-mail].