Security Engineer, Persona

• 3+ years of experience in IT security, corporate/enterprise security, or a related technical role. We'll flex on years of experience and specific tool background for candidates who demonstrate strong fundamentals, high aptitude, and a track record of figuring things out fast
• Hands-on experience with macOS endpoints, MDM platforms, and EDR tooling
• Experience with endpoint hardening. You’ve hardened endpoints, not written requirements asking someone else to do it
• Experience with DLP concepts and insider threat scenarios
• Experience with email security fundamentals and social engineering defense
• Ability to write scripts and automate workflows in Python, Ruby, Bash, or similar; comfortable with SQL
• Communicates clearly about security topics with non-technical stakeholders
• Experience in a high-growth startup or other fast-moving, resource-constrained environment

Desirable

• Persona builds identity verification infrastructure where security isn't a layer we add later, it's core to everything we ship
• When security fails at most companies, systems go down
• At an identity verification company, real people's identities are compromised
• This is an enterprise security role embedded in a generalist security team
• You'll work alongside experienced security engineers to defend Persona's people, devices, and systems against evolving threats - and build the tooling and automation that lets us do it at scale
• Develop, tune, and operate endpoint detection and response (EDR) rules and tooling across our macOS environment
• Partner with TechOps to implement security best practices across SaaS and endpoint environments, including 2FA enforcement, automated device encryption, and DLP. You will develop and deploy these controls - not ask other teams to do so for you
• Build tools and automation to scale security controls and monitoring without scaling headcount
• Harden corporate infrastructure and SaaS applications against attack
• Translate endpoint and SaaS telemetry into actionable mitigations and control recommendations
• Build and operate insider threat detection and response programs