Sr Security Engineer

Job Title: Sr Security Engineer(3-4ROLES)

Location : Onsite

• New York: 111 8th Avenue, New York, NY 10011
• San Francisco: 345 Spear Street, San Francisco, CA 94105

POSITION OVERVIEW

• The Security Engineer will join an operational security pod acting as the crucial bridge between automated security scanning/remediation systems and product code owners. The mission of this role is to streamline threat modeling, eliminate triage noise, validate exploitability through reproduction, verify automated/agentic patches, and shepherd open security issues through to verified production resolution.

DAY-TO-DAY RESPONSIBILITIES

• Document trust boundaries, data flows, and architectural entry points to maintain up-to-date threat profiles for high-priority services.
• Filter and triage findings from automated source and endpoint scanners, classifying severity and evaluating exception requests.
• Construct minimal test environments and reproduction harnesses to validate exploitability and eliminate false positives.
• Supervise and QA code patches generated by automated/agentic remediation tools, running unit and integration tests to check for regressions.
• Route validated patches to product team code owners and coordinate end-to-end deployment verification within strict SLAs.
• Conduct code reviews and ensure all fixes comply with secure coding standards (e.g., input validation, memory safety).

REQUIRED SKILLS

1. Threat Modeling

Understanding of architectural trust boundaries, attack surfaces, and data flows.

Familiarity with structured threat modeling frameworks (e.g., STRIDE, PASTA).

2. Triage & Policy Management

Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10).

Ability to interpret vulnerability scoring matrices and map findings to strict remediation SLAs.

3. Vulnerability Reproduction

Proficiency in reading and writing code in at least two core languages (C++, Go, Java, Python).

Ability to set up local test harnesses, mock dependencies, and build minimal PoCs.

4. Automated / Agentic Fixer QA

High attention to detail during code reviews (spotting hallucinations, regressions, off-by-one errors).

Understanding of secure coding standards (input validation, boundary checking, safe memory access).

NICE-TO-HAVES

Experience conducting threat model reviews for large distributed / microservice systems.

Ability to translate abstract system designs into concrete threat scenarios.

Experience managing vulnerability queues and reviewing compliance exception requests.

Familiarity with automated static/dynamic scanning tools.

Practical experience with fuzz testing, unit test frameworks, and sandbox execution.

Debugging complex runtime or logic errors across service boundaries.

Experience debugging and prompt-tuning automated code generation tools.

CANDIDATE PROFILE

An operational, hands-on Security Engineer with a strong software development background who excels at bridge-building between security automation and product development teams. The candidate should be highly methodical, possessing strong code analysis skills to spot hallucinated or regression-prone automated fixes and validate real-world exploitability.