Staff Security Engineer- Security and Compliance

veeamsoftware; San Jose (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Veeam, in partnership with Securiti, seeks a Staff Security Engineer to lead security across product and applications. You will shape secure architecture, strengthen SDLC, and drive vulnerability response for cloud and AI features.

This senior IC role involves threat modeling, security testing, and collaboration with engineering teams to ship secure SaaS offerings and maintain strong security posture.

Qualifications

• 8+ years in security and product/security for SaaS or cloud-native platforms.
• Strong coding and code-review skills in Go, Python, Java, or TypeScript.
• Deep knowledge of multi-tenant cloud security across AWS/Azure/GCP.
• Hands-on experience securing LLM-powered applications and related risks.
• Experience building or improving a secure SDLC across teams.
• Experience leading vulnerability response and coordinated disclosure.
• Knowledge of SBOM, signing, SLSA, SSDF concepts.
• Familiarity with SOC 2, ISO 27001, or FedRAMP.
• Strong communication with engineers, executives, auditors, and customers.
• CS degree or equivalent practical experience.

Responsibilities

• Own and evolve the secure SDLC across the product portfolio.
• Provide security leadership for AI capabilities and model risk.
• Improve SAST, dependencies, secrets, containers, SBOM controls.
• Lead product vulnerability response from repro to remediation.
• Perform targeted penetration testing and security research.
• Strengthen software supply chain security with SBOMs and signing.
• Build reusable security libraries and developer enablement.
• Track meaningful security metrics and adoption.

Skills

Security engineering

Cloud security

Threat modeling

Vulnerability response

LLM security

Security tooling

Go

Python

Java

TypeScript

Education

CS or engineering degree

Tools

SAST tooling

SBOM

CVE processes

Job description

Veeam is the Data and AI Trust Company, specializing in helping organizations ensure their data and AI are fully understood, secured, and resilient to enable the acceleration of safe AI at scale. As the market leader in both data resilience and data security posture management, Veeam is built for the convergence of identity, data, security, and AI risk. Headquartered in Seattle with offices in more than 30 countries, Veeam protects over 550,000 customers worldwide, who trust Veeam to keep their businesses running. Join us as we go fearlessly forward together, growing, learning, and making a real impact for some of the world's biggest brands.

About the Role

Securiti, now part of Veeam, builds the Data Command Center for data security, privacy, governance, and AI security. We are looking for a Staff Security Engineer to provide hands-on technical leadership across product and application security. You will shape secure architecture, strengthen the SDLC, lead vulnerability response, and help engineering teams ship secure cloud and AI capabilities at scale.

This is a senior individual-contributor role for someone who can move comfortably from threat models and pull requests to exploit validation, cloud security, software supply chain risk, and customer or auditor discussions.

What You’ll Do

Product & application security

• Own and evolve the secure SDLC across the Securiti portfolio, including threat modeling, design reviews, secure code review, and security testing.
• Provide security leadership for AI capabilities, including LLM-powered features, agents, copilots, prompt injection, retrieval leakage, permissions, and model supply chain risks.
• Tune and improve SAST, dependency, secrets, container, infrastructure, and SBOM controls so findings are actionable and integrated into engineering workflows.
• Lead product vulnerability response from reproduction and severity assessment through remediation, coordinated disclosure, CVE handling, and customer advisories.
• Perform targeted penetration testing and security research across applications, APIs, agents, connectors, and cloud services; scope and validate third-party testing.
• Strengthen software supply chain security through SBOMs, signed and reproducible builds, dependency governance, and secure release practices.
• Build reusable security libraries, reference implementations, hardening guidance, and developer enablement; help scale security through a Security Champions program.
• Track and communicate meaningful security metrics, including remediation time, critical/high findings, scan coverage, and engineering adoption.

Product compliance & assurance

• Partner with engineering on technical controls and evidence supporting SOC 2 Type II, ISO 27001/27701, ISO/IEC 42001, HIPAA, PCI, and FedRAMP Moderate readiness.
• Translate applicable requirements such as GDPR, CCPA, the EU AI Act, DORA, and NIS2 into practical engineering requirements and release criteria.
• Validate remediation of audit and penetration-test findings and escalated material risks.
• Serve as a technical security partner for customer due diligence, audits, security questionnaires, AI-risk reviews, and executive briefings.

Technical leadership

• Work across Engineering, Product, Platform, SRE, and Veeam Corporate Security to make security risk visible in architecture and roadmap decisions.
• Influence engineering standards and security strategy without relying on direct authority.
• Represent Securiti in technical discussions with customers, auditors, standards bodies, and the security research community.

What You’ll Bring

• 8+ years in security, with substantial experience in application or product security for SaaS or cloud-native platforms.
• Strong coding and code-review skills in one or more languages such as Go, Python, Java, or TypeScript, with the ability to validate vulnerabilities and build security tooling.
• Deep knowledge of multi-tenant cloud security across AWS, Azure, or GCP, including IAM, Kubernetes, secrets, tenant isolation, and protection of sensitive customer data.
• Hands-on experience securing LLM-powered applications, including prompt injection, retrieval leakage, agent authorization, and model supply chain risks.
• Demonstrated experience building or materially improving a secure SDLC across multiple engineering teams.
• Experience leading vulnerability response or coordinated disclosure, including severity assessment, CVE processes, remediation, and customer communications.
• Practical knowledge of software supply chain security, including SBOM, signing, SLSA, and SSDF concepts.
• Working experience with security assurance frameworks such as SOC 2, ISO 27001, or FedRAMP.
• Strong communication skills and the ability to explain technical risk clearly to engineers, executives, auditors, and customers.
• A computer science or engineering degree, or equivalent practical experience.

Bonus Skills

Experience with DSPM, privacy engineering, data governance, CASB, DLP, or othe