Staff Security Engineer

Riivet; Washington (Washington County); Hybrid; USD 150,000 - 230,000; Full time

Benefits offered by this job

Meaningful equity

Health, dental, and vision coverage

Budget for certifications, training, &

Job summary

Riivet is seeking a senior security engineer to become the first dedicated security hire, owning strategy and delivery for product hardening, data protection, and compliance. You will shape SOC 2 Type II readiness, manage audits and pentest coordination, and embed security across the development lifecycle.

You’ll protect a Next.js web app, Cloudflare Workers, and mobile clients, working with engineers, auditors, and customers on security questionnaires and vendor reviews.

Qualifications

• 7+ years in security engineering with depth in application and cloud security.
• Hands-on coding ability; able to read TypeScript and contribute PRs.
• Experience delivering SOC 2 Type II or ISO 27001 for a SaaS product.
• Knowledge of Postgres RLS, JWT-based auth, and multi-tenant SaaS pitfalls.
• Proven track record running a pentest program end-to-end.
• Strong written communication capable of explaining threats to engineers and buyers.

Responsibilities

• Own application and product security across Next.js app, Cloudflare Worker, and mobile clients.
• Harden Supabase and Postgres layer with RLS, isolation, secrets hygiene.
• Run and respond to pentests, bug bounties, and vulnerability scans; drive remediation.
• Own SOC 2 Type II readiness: controls, evidence, auditor coordination.
• Lead threat modeling and integrate security into development lifecycle.
• Own incident response: on-call rotation, playbooks, post-mortems, and customer communication.
• Handle inbound security questionnaires and procurement reviews.
• Set and enforce secrets rotation, access control, and vendor security cadence.

Skills

Application security

Cloud security

Security engineering

Coding in TypeScript

SOC 2 Type II readiness

Tools

PostgreSQL

RLS

JWT

Supabase

Cloudflare Workers

Job description

Own security at Riivet end to end: product, infrastructure, data, and compliance. First dedicated security hire reporting to the founder.

About the role

Riivet handles sensitive insurance claim data for restoration contractors, and our customers will increasingly ask us hard security questions. As the first dedicated security hire, you will set the strategy and ship the work yourself — product hardening, data protection, pentest coordination, vulnerability management, and the controls that get us a clean SOC 2 Type II report. You will partner closely with engineering, run our relationship with external auditors and pentesters, and own the answer when a prospect's security team sends a 300-question questionnaire.

What you'll do

• Own application and product security across the Next.js web app, Cloudflare Worker, and mobile clients
• Harden our Supabase and Postgres layer — RLS policy review, tenant isolation testing, secrets hygiene
• Run and respond to penetration tests, bug bounties, and vulnerability scans; drive remediation to close
• Own SOC 2 Type II readiness: controls, evidence collection, policy upkeep, auditor coordination
• Lead threat modeling on new features and build security into our development lifecycle
• Own incident response: on-call rotation, playbooks, post-mortems, and customer communication
• Handle inbound security questionnaires and procurement reviews with enterprise prospects
• Set and enforce our secrets rotation, access control, and vendor security review cadence

What we're looking for

• 7+ years in security engineering, with real depth in application and cloud security
• Strong hands-on coding ability — you can read a TypeScript codebase and send a pull request, not just file a ticket
• Experience taking a SaaS product through SOC 2 Type II (or ISO 27001) as a practitioner, not a consultant
• Working knowledge of Postgres RLS, JWT-based auth, and common SaaS multi-tenant pitfalls
• Track record of running a pentest program and resolving findings end to end
• Clear written communication — you can explain a threat model to an engineer and a risk to a buyer

Nice to have

• Direct experience with Supabase, Cloudflare Workers, or edge runtimes
• Background in handling regulated data (insurance, healthcare, finance)
• OSCP, CISSP, or equivalent certifications
• Experience building out an internal security program from zero
• Comfortable presenting to prospect CISOs and security teams on sales calls

What we offer

• Meaningful equity
• Health, dental, and vision coverage
• Budget for certifications, training, and tooling of your choice
• Remote work with team weeks in Jessup, PA and Seattle, WA
• Full ownership of a function that will define whether we win enterprise deals