Staff Security Engineer - Lead Cloud & Device Risk (Equity)

eightsleep; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Equity

Flexible paid time off

Health insurance

Vision and dental coverage

Parental leave

Commuter benefits

Job summary

Eight Sleep is seeking an energetic security generalist to own and improve security across cloud infrastructure, software, connected devices, corporate IT, identity, and AI use. This hands-on role centers on building a risk-based vulnerability program, automating repeatable security work, and partnering with engineering, research, clinical, and security leaders to make risks understandable and actionable.

The role requires practical experience automating security processes, clear technical

Qualifications

• Hands-on security leader with ownership of security across multiple environments.
• Ability to assess risk using exploitability and data sensitivity beyond scores.
• Experience automating security workflows and remediation processes.
• Clear writing and communication for engineers, auditors, and executives.

Responsibilities

• Run vulnerability management across cloud, containers, dependencies, devices and products.
• Set remediation targets and automate assignment, tracking and reporting.
• Manage software supply chain safeguards, including SBOM and CI/CD controls.
• Coordinate vulnerability intake, testing and patch rollout with hardware teams.
• Scope and manage penetration tests or bug bounty programs, with remediation triage.
• Support identity and device security, compliance controls, and safe AI adoption.

Skills

Vulnerability management

Automation of security processes

Cross-functional collaboration

Security across cloud and devices

Technical writing

Tools

CI/CD security

SBOM tooling

Vulnerability scanners

Job description

Eight Sleep is seeking an energetic security generalist to own and improve security across cloud infrastructure, software, connected devices, corporate IT, identity, and AI use. This hands-on role centers on building a risk-based vulnerability program, automating repeatable security work, and partnering with engineering, research, clinical, and security leaders to make risks understandable and actionable.

The role requires practical experience automating security processes, clear technical