Senior Security Engineer, MagicSchool AI

• Professional Experience: At least 5 years of experience in application or cloud security, with a track record of advancing security practices in fast-paced technical environments
• Security Expertise: Hands-on experience with secure development tooling (SAST, DAST, SCA), and cloud-native security within AWS and/or Google Cloud. Prior involvement in offensive security or red teaming
• Threat Modeling & Architecture: Strong experience conducting or facilitating threat modeling, whether using formal frameworks (e.g., STRIDE, PASTA) or more lightweight and iterative team-based approaches
• Communication & Influence: Ability to communicate complex security topics to both technical and non-technical stakeholders. Skilled in influencing engineering teams and leading by example
• Mentorship & Enablement: Experience coaching engineers or teams on security principles and integrating security without compromising developer velocity

Desirable

• As Senior Security Engineer (Application & Cloud Security), you will lead the development of secure engineering practices across our products and infrastructure
• In this hands-on, individual contributor role, you’ll drive threat modeling, secure architecture, and application security across our multi-cloud stack while partnering with teams across engineering, product, IT, and compliance
• You’ll report directly to the VP of Engineering and play a critical role in protecting the systems educators and students rely on every day
• This position is Remote (US-based)
• Secure Development Lifecycle: Champion secure development practices including threat modeling, code reviews, and vulnerability management. Lead the evaluation and implementation of tooling such as SAST, DAST, and SCA, and build developer-friendly workflows to “shift security left.”
• Secure Architecture & Design: Collaborate with product and engineering teams to design secure systems and deployment models grounded in zero trust principles. Serve as a trusted advisor on cloud security best practices across AWS and Google Cloud environments
• Internal Enablement: Lead security education programs for engineers and staff, including workshops, incident simulations, and best practice sharing. Coach engineers on practical security techniques and tradeoffs in the software development lifecycle
• Security Assessments & Red Teaming: Plan and execute internal offensive security exercises, including red team–style assessments, penetration testing, and adversary emulation
• Incident Response & Preparedness: Own and evolve security incident response playbooks. Collaborate with technical and operational teams on real-world incident response and postmortems
• Cross-Functional Alignment: Partner with IT and Compliance to support programs aligned with SOC 2, FERPA, and COPPA, ensuring engineering efforts align with our regulatory commitments

• Please note that applications for this position will be accepted until 7/18/25 — applications received after this date will be reviewed on an intermittent basis
• While we encourage early submissions, all applications received by the priority deadline will receive equal consideration