Senior Corporate Security Engineer

This is a fully remote position, open to applicants in California.

📋 Description

• Take ownership of corporate telemetry and detection content.

• Address detection coverage gaps while minimizing noise with accurate fidelity.

• Develop detections for account takeovers, session token theft, malicious OAuth grants, admin misuse, and insider data exfiltration.

• Lead corporate incident response efforts and manage incident response playbooks.

• Design and create a large language model (LLM)-driven agent for near-real-time assessment of privileged access grants, customer data access, and high-fidelity alerts related to endpoints and identities.

• Generate labeled evaluation sets to assess precision and recall.

• Establish boundaries on automated actions and protect against manipulation through log content or staff feedback.

• Oversee Mac fleet devices and endpoint detection together with the CorpSec team.

• Automate update enforcement, enhance EDR coverage, deploy browser-level data loss prevention (DLP), and enforce BYOD policies on iOS and Android devices.

• Maintain the identity provider and software-as-a-service (SaaS) portfolio.

• Ensure phishing-resistant authentication, address applications lacking SSO, automate access-review processes, and manage vendor and OAuth application reviews.

• Manage Google Workspace admin alerts, OAuth governance, Apps Script governance, sharing, and DLP.

• Collaborate with Engineering to test and implement detection updates based on the company’s Google Workspace tenant.

• Partner with AppSec on boundary detections between corporate and production environments, just-in-time access, and logging practices.

• Transform corporate security insights into enhancements for product detection for customers.

⛳️ Requirements

• Minimum of 6 years of experience in corporate or enterprise security, or detection and response.

• Practical experience managing a SIEM, detection content, and incident response processes.

• Proficient in Python, Go, or TypeScript with hands-on experience using vendor APIs.

• In-depth knowledge of OAuth, SAML/OIDC, session and token lifecycles, and the integration of identity with cloud IAM.

• Experience in managing a Mac fleet using modern MDM and EDR solutions, ensuring compliance from deployment to enforcement.

• Experience in developing or significantly experimenting with LLM-driven workflows, including prompting, tool utilization, and evaluation methodologies.

• Ability to articulate methods for measuring the performance of LLM workflows.

• Collaborative, inquisitive, and straightforward approach to teamwork.

• Experience mentoring junior engineers without overshadowing their contributions.

• Preferred: Contributions to detection logic or security features within a product codebase.

• Bonus: Technical publication, conference presentation, or development of open-source security tools.

🏝️ Benefits

• Remote-first working environment.

• Office located in San Francisco, California.

• Commitment to equal employment opportunities and an inclusive workplace culture.