Senior Corporate Security Engineer, Material Security
$220-240k
Security for Google Workspace & Microsoft 365
Be an early applicant
Security for Google Workspace & Microsoft 365
21-100 employees
Be an early applicant
$220-240k
21-100 employees
Company mission
Their goal is resilience, and they build security that works (and works simply).
Role
Who you are
- You have owned a corporate stack end to end — devices, identity, SaaS, collaboration — and turned controls that were deployed into controls that are enforced
- You treat the IdP, the device fleet, and the SaaS estate as one system, and you harden the paths between them rather than each tool in isolation
- You have written detections that caught real attacks and removed the noise that buried the team, and you can explain how you measured the difference
- You have responded to live incidents and made the containment call. You know what to revoke first
- When a job requires someone to do something manually and repetitively, your instinct is to build the system that makes that job unnecessary
- You have put an LLM into a security workflow, measured it, and have specific views about where it should and should not be trusted
- You work through design decisions by asking questions on both sides, and when the call goes against you, you respect it and build it
- Bonus: you have written a technical paper, spoken at a technical conference, or maintain open-source security tooling
- Operator Depth: 6+ years in corporate or enterprise security or detection and response, with hands-on ownership of a SIEM, detection content, and incident response
- Software Engineering: Comfortable in Python, Go, or TypeScript working directly against vendor APIs. You automate enforcement rather than configuring it by hand
- Identity Fundamentals: Deep understanding of OAuth, SAML/OIDC, session and token lifecycle, and how identity reaches cloud IAM
- Endpoint Fluency: You have managed a Mac fleet with a modern MDM and EDR and taken it from deployed to enforced
- Applied LLM Judgment: You have built or seriously experimented with LLM-driven workflows, including prompting, tool use, and evaluation, and can explain how you would know whether one is doing a good job
- Software Development (nice to have): You have contributed detection logic or security features to a product codebase and are comfortable working inside an engineering team's review and release process
- How You Work: Collaborative, curious, direct. You work well next to more junior engineers without taking over, and you would rather engineer a problem away than staff it
What the job involves
- Material works with some of the most sophisticated security teams in the industry. These customers have entrusted us with protecting one of their most critical assets: Google Workspace. Your mission is to make our own corporate environment worthy of that trust: take a mature security program and make it rigorous, measured, and adapted to the new generation of LLM-based security tooling
- Success means we can detect and defend against sophisticated attacks. This includes hardening our corp services, increasing detection efficacy while reducing response times, and making sure our employees are working with customer data in ways that reflect the trust of our customers
- Concretely: bring your experience to identify and close gaps in our environment, rebuild our detection and response around LLMs — and be customer zero for our own product, working with Engineering to turn what you learn into detection improvements that ship to every customer
- The environment is what you’d expect at a modern startup: Mac-only fleet, Google Workspace, expected security services like a SIEM, IdP, EDR, fleet management and a cloud production environment. Our security posture is more mature than typical for a company our size
- Detection and Response (own): Own corporate telemetry and the detection content on it. Close coverage gaps, reduce noise with measured fidelity, and build detections for what matters here: account takeover, session token theft, malicious OAuth grants, admin abuse, and exfiltration by someone who legitimately has access. Lead corporate incident response and own the playbooks
- LLM-Driven Triage (own): Design and build the agent that reviews privileged access grants, customer data access, and high-fidelity endpoint and identity alerts in near real time, with labeled evaluation sets, measured precision and recall, explicit limits on automated action, and a defense against being steered by log content or an employee's reply
- Endpoint (shared with the CorpSec team): Device management and endpoint detection for the Mac fleet. Automate update enforcement, deepen EDR coverage, bring browser-level DLP to the fleet, and enforce BYOD posture on iOS and Android
- Identity and SaaS (shared with the CorpSec team): The identity provider and the SaaS estate. Maintain phishing-resistant authentication everywhere, address the applications that cannot do SSO, automate access-review evidence, and turn manual vendor and OAuth application review into a pipeline
- Google Workspace (shared with the CorpSec team): Admin alerting, OAuth governance, Apps Script governance, sharing, and DLP, using our own product where it fits. Partner with Engineering to propose, test, and ship detection updates to the product based on what you see in our own tenant
- Corporate to Production (shared with AppSec): The boundary between corporate and production: detections that cross it, just-in-time access, and the logging that shows who touched what
Our take
Email hacks are a real and immediate threat for businesses. Material Security is setting out to solve this problem by protecting companies and their employees.
Material Security was founded following the 2016 election hacking scandal, tapping into widespread demand for more resilient email protection. The company is led by a team of experienced ex-Google and Dropbox managers, which has shaped its tech considerably. The company is now valued at over $1 billion, an impressive testament to the quality of its solutions.
Material Security's main challenge will be competing with rival security providers. However, given its unicorn status, the company is likely to scale even further in the coming years and is well poised to open up a significant market lead.
Freddie
Company Specialist at Welcome to the Jungle
Company
Funding (last 2 of 3 rounds)
May 2022
$100m
SERIES C
May 2021
$40m
SERIES B
Total funding: $162m
Company benefits
- Remote-first
- 100% coverage of Health, Dental, & Vision premiums for employees and dependents
- In-person company gathering twice a year
- Competitive salary & equity
- Mental Health benefits through Spring Health
- 401(k) plan
- Up to 16 weeks parental leave
- Office equipment coverage and support
- Stipend for cell phone & internet
- AI-native workplace with full access to today's productivity tools (Claude, Cursor, and many more)
- Material Security swag throughout the year
Company HQ
SoMa, San Francisco, CA
Leadership
Ryan Noon
(Co-Founder & Chairman)Ryan previously founded Parastructure, which was acquired by Dropbox. They then went on to serve as the Head of Analytics at Dropbox before co-founding Material Security in 2017.
Abhishek Agrawal
(Co-Founder & CEO)After co-founding Material Security in 2017, Abhishek initially served as the company's CTO until 2023, when they moved into the role of CEO. Previously, they were a Senior Product Manager at Dropbox and a Software Development Engineer at Microsoft Office Labs.
Christopher Park
(Co-Founder & VP Engineering)Christopher previously worked as a Senior Software Developer at Camstar Systems, as a Software Engineer at Google and Parastructure, and as an Engineering Manager at Dropbox.
Share this job
View 3 more jobs at Material Security