Staff Security Engineer

Stack

Responsibilities

• ▹Lead security architecture and design reviews across applications, infrastructure, and integrations
• ▹Conduct and coordinate penetration testing, threat modeling, and security reviews for critical services, new features, and third-party integrations
• ▹Design and implement security automation within CI/CD pipelines to enforce secure coding practices and infrastructure policies
• ▹Partner with infrastructure and DevOps teams to secure cloud platforms (AWS) and improve identity, network, and workload security
• ▹Build security observability and detection capabilities, including security data pipelines, SIEM integrations, and threat intelligence signals
• ▹Think like an attacker: identify systemic weaknesses and design controls that protect against entire classes of attacks
• ▹Work closely with developers through secure architecture guidance, code review support, and developer enablement
• ▹Lead incident response investigations and build processes for identifying, analyzing, and mitigating security incidents
• ▹Own and evolve the bug bounty program, including triage, response processes, and vulnerability management workflows
• ▹Develop security standards, playbooks, and training programs
• ▹Help define the security roadmap

Requirements

• ▹Deep understanding of application security, cloud security, and modern threat landscapes, including common vulnerabilities and attack techniques (OWASP Top 10, MITRE ATT&CK, etc.)
• ▹Strong software engineering background with experience writing production-grade code or automation (Python, TypeScript, or similar)
• ▹Hands-on experience securing cloud-native infrastructure, especially AWS, including IAM, networking, and containerized workloads
• ▹Experience building or integrating DevSecOps pipelines, including SAST, DAST, IaC scanning, and container security tooling
• ▹Experience designing security telemetry pipelines using SIEM platforms, observability systems, or data lakes
• ▹Experience running or participating in penetration testing, threat modeling, or architectural security reviews
• ▹Proven ability to collaborate with engineering, DevOps, and product teams
• ▹Excellent communication skills, able to explain complex security risks and trade-offs to technical and non-technical stakeholders
• ▹Strong understanding of SaaS architectures, distributed systems, and internet-facing platforms
• ▹Experience developing security frameworks aligned with CIS benchmarks, NIST, or SOC2 / PCI / HIPAA compliance requirements
• ▹Experience building security detections, threat intelligence pipelines, or runtime protection mechanisms
• ▹Hands-on experience with Kubernetes, container security, and infrastructure-as-code (Terraform, Ansible)

Soft skills

What we offer

• ▹Competitive salary and equity packages for all employees
• ▹Platinum medical, dental, and vision healthcare plan
• ▹Free life insurance, including long-term and short-term disability
• ▹Unlimited PTO and paid holidays
• ▹Maternity and paternity family leave
• ▹401(k) contribution: 3% of income, even if you do not contribute
• ▹WFH benefits: lunch on the company twice a week, monthly phone stipend, and other home office perks
• ▹Health FSAs and HSAs for pre-tax out-of-pocket medical expenses
• ▹Team events and offsites for the remote team

About the company

Assured is modernizing insurance, providing large insurers with software from self-service claim filing to backend fraud detection so that claims processing becomes less manual.