Sr. Corporate Security Engineer

Role overview Strengthen a mature corporate security program by improving detection, incident response, identity controls, endpoint protections, and the boundary between corporate systems and production. The role pairs hands-on security operations with software engineering: automate enforcement and response, evaluate AI-assisted triage carefully, and share lessons with product engineering to improve shipped detections. The environment includes a Mac fleet, Google Workspace, security monitoring and endpoint tools, and cloud production systems.

Responsibilities - Own corporate security telemetry and detection content; close coverage gaps, reduce alert noise using measured results, and detect account takeover, token theft, malicious OAuth grants, administrator abuse, and unauthorized data movement. - Lead incident response, make containment decisions, and maintain response playbooks. - Build an AI-assisted triage workflow for privileged access, customer-data access, and high-confidence endpoint or identity alerts. Evaluate it with labeled data, precision and recall measures, and clear limits on automated actions. - Improve Mac fleet management and endpoint detection, including update enforcement, endpoint coverage, browser-level data controls, and device posture checks for personal mobile devices. - Strengthen identity and SaaS controls, including phishing-resistant authentication, access review evidence, and automated review of vendors and OAuth applications. - Improve collaboration platform governance and corporate-to-production monitoring, and work with product engineers to test and deliver useful detection improvements.

Requirements - At least six years in corporate or enterprise security, or detection and response, with direct ownership of a SIEM, detection content, and incident response. - Ability to write software in Python, Go, or TypeScript and work directly with vendor APIs to automate security enforcement. - Deep understanding of OAuth, SAML/OIDC, session and token lifecycles, and the connection between identity systems and cloud access management. - Experience managing a Mac fleet with modern device management and endpoint detection tools, including moving controls from deployment to consistent enforcement. - Practical experience building or evaluating LLM-driven workflows, including prompting, tool use, and evaluation; able to define where automation should be trusted. - Collaborative, direct working style and ability to support less experienced engineers while independently driving security improvements.

Nice to have - Experience contributing detection logic or security features to a product codebase and working within an engineering review and release process. - A technical publication, conference presentation, or maintained open-source security tool.

Benefits and work setup - Remote-first workplace with an office in San Francisco. - Listed annual compensation range: $220,000–$240,000.