Security Engineer

Requirements:

• 4-10 years of software or security engineering experience. We will make exceptions for exceptional people in either direction.
• Strong software-engineering fundamentals and evidence that you have built, shipped, and operated security-relevant production systems, not only assessed them.
• Depth in at least two of product security, application security, identity and authorization, cloud or infrastructure security, platform security, software supply chain, offensive security, or detection and response.
• Experience threat-modeling complex systems, finding realistic failure paths, and translating them into proportionate controls and executable tests.
• The ability to review code and architecture, reproduce vulnerabilities, build reliable tooling or services, and verify that remediation actually closes the issue.
• Strong understanding of trust boundaries, least privilege, identity, authorization, secrets, cryptography, isolation, secure software design, and common web and distributed-systems vulnerabilities.
• An attacker's curiosity paired with a builder's judgment. You can demonstrate how a system fails, but your work is not finished until the safer path works in production.
• Practical risk judgment. You distinguish plausible impact from theoretical concern, prioritize the highest-leverage work, and avoid both security theater and reckless shortcuts.
• A collaborative approach that raises engineering velocity and ownership rather than turning security into a late-stage approval queue.
• Clear written and verbal communication. You can explain a subtle exploit to an engineer, a control gap to leadership, and an evidence-backed posture to a customer's security team.
• AI-native. You use modern AI systems and coding agents to expand your coverage while independently validating findings, exploitability, and remediation.
• Comfort with startup ambiguity, broad ownership, and occasional customer travel.