Senior Engineer, Security Engineering

We are seeking an experienced Senior Engineer to help strengthen and reinforce our security processes, workflows, and posture as it relates to our applications, cloud infrastructure, and platform. In this role, you won't just be patching what's already broken; you will be defining how we find and close exposures before they're used against us. You will own and engineer the detection, investigation, and response capabilities that protect our global platforms while leading the charge into AI-augmented defense, using AI to compress the time between a vulnerability's disclosure and its exploitation in the wild.

** Please note that this opportunity is located in New York, NY, and requires this hire to work from our office four days a week. **

• Security Architecture & Tooling: Own our SAST/DAST program end-to-end, selecting, tuning, and integrating static and dynamic analysis tooling into the CI/CD pipeline so vulnerabilities are caught before merge, not after breach.
• AI & Agentic Defense: Proactively identify and build AI/LLM-driven agents that close the gap between exposure and detection. CVE feeds alone are a shrinking signal in an AI-accelerated threat landscape, so we need LLM inference layered at multiple points in the platform: dependency and supply-chain analysis, code-level review, and runtime behavior, catching what a CVE number never will.
• Deep Investigation: Own security incidents end-to-end, from the first anomalous signal, through root-cause analysis and remediation, to the post-mortem that prevents recurrence. You follow a problem to completion; you don't hand it off halfway through.
• Read by Code: Read code fluently enough to validate a finding at the source rather than taking a scanner's word for it. You won't be writing production code daily, but you need to be comfortable in at least one systems language (C, C++, Rust, or similar languages) well enough that reading it critically, and catching what's wrong with it, is second nature.
• Vulnerability & Threat Management: Lead vulnerability management and threat modeling across our entire environment, internal and external, prioritizing based on real-world exploitability and business impact, not just CVSS score.
• Compliance & Trust: Partner with legal, IT, and leadership to maintain and mature our compliance posture (SOC 2 Type II, ISO 27001, InfoSec, and customer security questionnaires), translating audit and control requirements into practical engineering work rather than checkbox paperwork.
• Mentorship & Influence: Act as a force multiplier by mentoring engineers and influencing cross-functional product teams on secure coding, threat modeling, and security-first development.
• Incident Response: Serve as a high-level escalation point for complex security incidents, conducting deep-dive post-mortems that drive structural improvements rather than quick fixes.

What You'll Do

• A Student of the Craft: You're less interested in being the smartest person in the room than in staying honest about how fast the room is changing. AI has rewritten the security landscape almost overnight, and some of the assumptions and playbooks that worked two years ago no longer hold. You know your way around Arxiv and ACM, and keep a genuine eye on the research as it's published, not just the vendor’s take on it three months later. You track where the industry is headed, not just where it's been, and you're comfortable saying "that doesn't work anymore" and rebuilding the approach.
• Secure by Design: You have hands-on experience with secrets management (Vault, AWS KMS/Secrets Manager, or similar), secure API design (authN/authZ, input validation, rate limiting), and system hardening standards like CIS Benchmarks and SELinux/AppArmor.
• The "AI Native" Defender Mindset: You are passionate about the intersection of security and AI, and you think beyond CVE feeds, you want LLM inference embedded at multiple layers of the platform (supply chain, code, runtime) doing the correlation and triage a human can't keep pace with alone. To you, an LLM is nothing more than a non-deterministic program, and you can tell the difference between a genuine threat and hype.
• Proven Track Record: You have 8+ years of experience in Security Engineering, AppSec, Vulnerability Research, or Incident Response, with at least 2 years in a Senior-level capacity driving cross-team initiatives.
• Foundational & Polyglot: You can write in a systems-level language, such as C, C++, Rust, Go, or ASM, not because you'll ship production code daily, but because writing it is what makes reading it, and anything else in the stack (Ruby, Node.js, Java, Typescript, Python), critically possible. If the moment ever calls for it, you can pop open a shared object in a disassembler and figure out what is actually happening.
• Investigator's Mindset: You are a relentless, curious investigator who follows a problem from initial exposure to root cause to full closure, paired with a genuine hunger to learn that keeps you ahead of new attack techniques and defensive tooling. You respond in measured steps, not everything is a crisis, and you understand that "don't panic" is a discipline, not just a slogan.
• Compliance Fluency: You're comfortable operating within SOC 2, ISO 27001, or similar compliance frameworks, and know how to satisfy an audit's control requirements without over-engineering the underlying system.
• Autonomous Operator: You take direction from your team lead on priorities, but how you plan and execute against those priorities, and how you go about securing the environment day to day, is up to you. If you spot a gap, something that needs doing and isn't on the agenda, you don't wait for it to be assigned, you raise it and work with your lead to get it prioritized.

What VTS Values & How We Show It

Privacy Policy