Member of Technical Staff, Security

What you'll do

In your first 90 days, you'll learn our environment, take ownership of [focus area], and work with Infrastructure to close the highest-risk gaps in our AWS environment. You'll also tune our existing CI/CD and cloud scanning so findings are accurate, prioritized, and fixed on schedule.

Over time, you'll take on broader responsibility

• Run and mature our vulnerability management program across infrastructure, applications, and dependencies, including triage, severity-based remediation targets, and exception handling
• Triage and respond to findings from automated tooling, bug bounty reports, and third-party assessments
• Enforce least-privilege access and run regular access reviews across environments
• Work with Infrastructure to improve detection and monitoring using log aggregation and SIEM tooling
• Provide engineering evidence (scans, access reviews, hardening) that supports continuous SOC 2 compliance, working with our GRC team
• Support customer security reviews by answering technical questions from enterprise buyers
• Lead post-incident reviews and drive systemic fixes
• Contribute to risk assessments and the risk register, and help set priorities

Must have

• 5+ years in security engineering, including time in high-growth SaaS or infrastructure-heavy environments
• Experience supporting or maintaining a SOC 2 program
• Strong knowledge of AWS security services and cloud security architecture (IAM, VPC, CloudTrail, GuardDuty, Security Hub)
• Solid understanding of identity and authentication protocols (OAuth, SAML, OIDC)
• Scripting skills in Python or Bash to automate security workflows

Strong plus

• Experience running vulnerability management and security scanning (SAST, DAST, SCA, container scanning) in CI/CD workflows
• Infrastructure-as-code security experience (Terraform, CloudFormation)
• Familiarity with network security fundamentals (firewalls, DNS, VPNs, segmentation, traffic analysis)
• Background in penetration testing, application security assessments, or CTF competitions
• Familiarity with data infrastructure security for systems like ClickHouse or PostgreSQL
• Experience with data processing compliance in analytics-heavy environments
• Relevant certifications (CISSP, CCSP, AWS Security Specialty, or similar)

Who you are

• A clear communicator who can explain security risk in business terms to engineers, leadership, and customer-facing teams
• A systems thinker who reasons about root causes, blast radius, and scalable control design
• Self-directed, with sound judgment, and effective as part of a team that shares ownership of the program
• Motivated to strengthen the security program of a category-defining AI company

Compensation

The expected base salary range is $200,000 to $250,000 (NYC). Total compensation includes base salary, equity, and a full range of benefits and perks. Final compensation depends on skills, experience, qualifications, and location, and is set during the interview process. Our recruiting team will share the full package as you move through hiring.

#LI-PRO

Note: All official communication from Profound will come from a @tryprofound.com email address. If you're contacted by anyone using a different domain, please disregard and report it as spam.