Lead Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop Buffer’s security strategy and roadmap, prioritize initiatives, drive implementation, and set security standards.

• Detect security issues, outline solutions, and create tools, automation, and processes.

• Incorporate security into development practices through PR checks, threat modeling, dependency management, secrets handling, and supply-chain hygiene.

• Enhance operational security while maintaining Buffer’s high-trust environment.

• Oversee the security inbox, manage requests from other teams, and handle maintenance and administrative tasks.

• Lead security incidents and engage in the engineering-wide on-call rotation.

• Conduct incident response exercises and ensure that identified issues are addressed.

• Threat-model AI agents, connectors, and in-product AI; set security guidelines.

• Assess vulnerability-disclosure reports and manage the vulnerability disclosure program.

• Take ownership of SOC 2 compliance, Meta platform compliance, customer security questionnaires, and customer trust initiatives.

• Work in collaboration with product engineering teams on technical specification reviews and develop security champions.

• Assist Advocacy and People teams with security and compliance requirements.

• Report directly to Miguel, Engineering Manager for Infrastructure and Security.

⛳️ Requirements

• Must reside between UTC-3 and UTC+3.

• Extensive security experience without a CISO overseeing your work.

• Practical experience in application and API security within a multi-tenant SaaS environment, preferably with a public API.

• Knowledge of authorization models, OAuth, OIDC, session and authentication flows, IDOR, SSRF, and threat modeling.

• Proven track record of identifying and resolving security vulnerabilities.

• Proficiency in writing and modifying TypeScript code and conducting code reviews; familiarity with legacy PHP and Python is a plus.

• Experience managing security incidents from start to finish, including updates, customer communications, and postmortem analyses.

• Familiarity with AWS, Kubernetes, and Cloudflare, or equivalent technologies.

• Experience leading or closely supporting a SOC 2 or similar compliance program.

• Skilled in automating evidence collection processes.

• Experience managing or triaging a vulnerability disclosure or bug bounty program.

• Proficiency with modern AI tools and experience securing systems that utilize them.

• Ability to excel in remote, asynchronous work environments.

• Excellent written communication skills and commitment to follow-through.

• Familiarity with Buffer or social media management tools is advantageous.

• At least one year of experience working fully remotely as part of a distributed team.

• Recent experience merging code into a production codebase that has been reviewed by other engineers within the last 12 months.

🏝️ Benefits

• Equity.

• Two paid days for team collaboration during the collaboration period.

• Fully remote and distributed work environment.

• Opportunity to travel for in-person collaboration once or twice a year.

• A transparent, fair, straightforward, and generous compensation structure.