Security Engineer, Enterprise Security

Responsibilities

Endpoints and Access

• Build the endpoint hardening controls across macOS, Windows, Linux, and ChromeOS. Our fleet runs on FleetDM, an osquery-based MDM managed through GitOps: you author the control, you write the query proving it landed, and you ship both in a merge request for review.
• Bind data access to a healthy managed device and the person it was issued to: phishing-resistant factors, session lifetimes, and device posture checks.
• Bring AI assistants and coding agents under enterprise management: configuration and permissions delivered and verified like any other endpoint control.

Applications and Third Parties

• Design application authentication, RBAC, and access lifecycle from first principles: identify what an application exposes, threat model it, propose control requirements, and guide owners to implement them.
• Contribute what each engagement teaches to the team's default deployment playbooks: authentication, logging, and network placement.
• Run security review and governance for SaaS and third parties: vendor assessments, OAuth grants, connector integrations, browser extensions, and data movement through the browser.

Visibility and Measurement

• Build the inventories this work depends on: application discovery, application posture management, grant tracking. Feed vulnerability management and build the controls that close what it finds.
• Threat model the corporate attack surface as a repeatable practice and feed the results into what the team works on next. Partner with Detection and Response on telemetry and with IT on rollout.
• Use AI where it earns its place: prepping access reviews, first-pass triage, and analysis that gets a human to a decision faster.

Requirements

• Software engineering discipline in Python, Bash, PowerShell, or similar: integrations and internal tooling as normal work.
• Configuration-as-code and CI/CD applied to corporate infrastructure.
• Threat-modeling judgment that separates the problems worth solving from the ones existing controls already cover, and drives the former to completion.
• 6+ years in corporate or enterprise security engineering.
• Bachelor's in Computer Science, Engineering, or Information Systems, or equivalent experience.

Bonus Qualifications

• Endpoint security on at least two of macOS, Windows, Linux, and ChromeOS: MDM profile engineering, application allowlisting, endpoint security frameworks, and the OS internals behind them. Preferred: fleet-wide osquery telemetry, certificate-based device identity in production, a phased enforcement change shipped with a recovery plan, and devices that live off the corporate network.
• Identity and access: IAM, SaaS security, and zero trust from fundamentals rather than vendor docs, and being able to explain a SAML, OIDC, or SCIM integration for a developer who has never built one. Preferred: mTLS, 802.1X, SSH certificate authorities, and DKIM, DMARC, and SPF in production.
• Application access design: threat modeling what an application exposes, specifying authentication and authorization for the team building it, and designing the provisioning and revocation behind it. Preferred: securing agentic or LLM-integrated systems, including permission models, credential isolation, and egress control.

Pay and benefits

The US base salary range for this full-time position is $150,000 to $250,000 per year.

The pay offered for this position may vary based on several individual factors, including job-related knowledge, skills, and experience. The total compensation package may also include additional components/benefits depending on the specific role. This information will be shared if an employment offer is extended.