Staff Security Engineer, EvenUp

• 8+ years in a security-focused engineering role, with hands-on technical architecture, implementation, and oversight experience
• Expertise in SAST/DAST, application security, and CI/CD pipeline integration
• Deep knowledge of AI-specific threats (prompt injection, model poisoning, membership inference, adversarial perturbation, output manipulation)
• Experience implementing security principles, operating system and web application security, and familiarity with the OWASP Top 10 and common threat tactics
• Knowledge of next-generation security technologies (SASE, CASB, RASP)
• Hands-on experience with patch management, software supply chain security, and artifact repositories (e.g., JFrog, Snyk)
• Strong programming or scripting skills in at least one language (e.g., Python, Ruby, Node.js)
• Relevant cybersecurity certification (CISSP, CISM, CISA, CRISC, GIAC, etc.)
• Up-to-date on technology and vulnerability trends; ability to secure cloud computing applications and ecosystems
• Application/infrastructure-level security design experience, including modern mitigation techniques (e.g., DNS-SEC, cryptographic fundamentals)
• Strong automation skills with Python

Desirable

• EvenUp’s infrastructure team is growing rapidly to support the company’s mission of ensuring personal injury victims receive fair compensation
• With ambitious goals to double the size of our engineering team by the end of 2026, we are looking for a hands-on Senior Security Engineer to lead and scale our security efforts
• You’ll work across functions to design and maintain secure infrastructure, evaluating whether to build or buy solutions as we grow
• Your work will be critical in safeguarding our AI-native document generation platform, trusted by attorneys with over $1.5B in damages claimed to date
• As a Staff Security Engineer at EvenUp, you will set security strategy, collaborate with cross-functional partners, and drive major initiatives that secure customer data, our products, and our company’s reputation
• Risk Management: Identify and address security risks through comprehensive assessments, mitigation strategies, and execution
• Code and Network Security: Ensure secure coding and implement systems to protect against unauthorized access and data breaches
• Incident Response: Develop and execute incident response plans, conduct forensic analysis, and take preventive measures
• Compliance and Ethics: Maintain compliance with regulations and industry standards, promote transparency, and address ethical concerns
• Continuous Monitoring: Establish real-time monitoring systems, conduct regular assessments, and proactively respond to threats
• Vendor & Third-Party Security: Evaluate and secure third-party integrations to prevent vulnerabilities
• Security Training: Educate and raise awareness for security best practices across the engineering team
• Documentation & Reporting: Maintain up-to-date documentation on protocols, incidents, and improvements; report regularly to stakeholders
• Mentorship: Mentor and guide team members to build security expertise across the engineering organization