Senior Engineer, VTS
Security Engineering
$160-200k
4 days a week in office
Commercial real estate technology solution
Be an early applicant
Commercial real estate technology solution
501-1000 employees
Be an early applicant
$160-200k
4 days a week in office
501-1000 employees
Company mission
To unify owners, operators, brokers, and tenants to capitalize on opportunities revealed in every square foot of their properties.
Role
Who you are
- A Student of the Craft: You're less interested in being the smartest person in the room than in staying honest about how fast the room is changing. AI has rewritten the security landscape almost overnight, and some of the assumptions and playbooks that worked two years ago no longer hold. You know your way around Arxiv and ACM, and keep a genuine eye on the research as it's published, not just the vendor’s take on it three months later. You track where the industry is headed, not just where it's been, and you're comfortable saying "that doesn't work anymore" and rebuilding the approach
- Secure by Design: You have hands-on experience with secrets management (Vault, AWS KMS/Secrets Manager, or similar), secure API design (authN/authZ, input validation, rate limiting), and system hardening standards like CIS Benchmarks and SELinux/AppArmor
- The "AI Native" Defender Mindset: You are passionate about the intersection of security and AI, and you think beyond CVE feeds, you want LLM inference embedded at multiple layers of the platform (supply chain, code, runtime) doing the correlation and triage a human can't keep pace with alone. To you, an LLM is nothing more than a non-deterministic program, and you can tell the difference between a genuine threat and hype
- Proven Track Record: You have 8+ years of experience in Security Engineering, AppSec, Vulnerability Research, or Incident Response, with at least 2 years in a Senior-level capacity driving cross-team initiatives
- Foundational & Polyglot: You can write in a systems-level language, such as C, C++, Rust, Go, or ASM, not because you'll ship production code daily, but because writing it is what makes reading it, and anything else in the stack (Ruby, Node.js, Java, Typescript, Python), critically possible. If the moment ever calls for it, you can pop open a shared object in a disassembler and figure out what is actually happening
- Investigator's Mindset: You are a relentless, curious investigator who follows a problem from initial exposure to root cause to full closure, paired with a genuine hunger to learn that keeps you ahead of new attack techniques and defensive tooling. You respond in measured steps, not everything is a crisis, and you understand that "don't panic" is a discipline, not just a slogan
- Compliance Fluency: You're comfortable operating within SOC 2, ISO 27001, or similar compliance frameworks, and know how to satisfy an audit's control requirements without over-engineering the underlying system
- Autonomous Operator: You take direction from your team lead on priorities, but how you plan and execute against those priorities, and how you go about securing the environment day to day, is up to you. If you spot a gap, something that needs doing and isn't on the agenda, you don't wait for it to be assigned, you raise it and work with your lead to get it prioritized
What the job involves
- We are seeking an experienced Senior Engineer to help strengthen and reinforce our security processes, workflows, and posture as it relates to our applications, cloud infrastructure, and platform
- In this role, you won't just be patching what's already broken; you will be defining how we find and close exposures before they're used against us
- You will own and engineer the detection, investigation, and response capabilities that protect our global platforms while leading the charge into AI-augmented defense, using AI to compress the time between a vulnerability's disclosure and its exploitation in the wild
- You will act as the bridge between deep, code-level investigation and enterprise-wide risk reduction, ensuring our software supply chain, cloud infrastructure, and applications are not just compliant, but resilient by design
- Security Architecture & Tooling: Own our SAST/DAST program end-to-end, selecting, tuning, and integrating static and dynamic analysis tooling into the CI/CD pipeline so vulnerabilities are caught before merge, not after breach
- AI & Agentic Defense: Proactively identify and build AI/LLM-driven agents that close the gap between exposure and detection. CVE feeds alone are a shrinking signal in an AI-accelerated threat landscape, so we need LLM inference layered at multiple points in the platform: dependency and supply-chain analysis, code-level review, and runtime behavior, catching what a CVE number never will
- Deep Investigation: Own security incidents end-to-end, from the first anomalous signal, through root-cause analysis and remediation, to the post-mortem that prevents recurrence. You follow a problem to completion; you don't hand it off halfway through
- Read by Code: Read code fluently enough to validate a finding at the source rather than taking a scanner's word for it. You won't be writing production code daily, but you need to be comfortable in at least one systems language (C, C++, Rust, or similar languages) well enough that reading it critically, and catching what's wrong with it, is second nature
- Vulnerability & Threat Management: Lead vulnerability management and threat modeling across our entire environment, internal and external, prioritizing based on real-world exploitability and business impact, not just CVSS score
- Compliance & Trust: Partner with legal, IT, and leadership to maintain and mature our compliance posture (SOC 2 Type II, ISO 27001, InfoSec, and customer security questionnaires), translating audit and control requirements into practical engineering work rather than checkbox paperwork
- Mentorship & Influence: Act as a force multiplier by mentoring engineers and influencing cross-functional product teams on secure coding, threat modeling, and security-first development
- Incident Response: Serve as a high-level escalation point for complex security incidents, conducting deep-dive post-mortems that drive structural improvements rather than quick fixes
Our take
Commercial real estate is a difficult business sector to plan for, especially for the largest firms managing huge portfolios of prime office space. Marketing, leasing, data analytics and retention efforts have traditionally required an array of different solutions, often poorly integrated (if at all), and decision-making is often stymied by inaccurate reporting and inflexible, clunky tools.
VTS, a leading player in the commercial real estate tech sector, seeks to change this by unifying every real estate asset and function in a single platform. Combining marketing, asset management and reporting functions into a single interface, it also delivers data insights for decision-makers to inform their investment and asset strategies.
VTS's user base has grown to over 45,000 commercial real estate firms including Blackstone, Brookfield Properties, and LaSalle Investment Management, and about 60% of the US's top quality office space is managed through its platform. Having raised a significant amount of funding it is investing heavily in research and development, sourcing strategic acquisitions and hiring additional talent.
Steph
Company Specialist at Welcome to the Jungle
Insights
-5% employee growth in 12 months
Company
Funding (last 2 of 9 rounds)
Sep 2022
$125m
SERIES E
May 2019
$90m
SERIES D
Total funding: $304.6m
Company benefits
- Parental Leave: 16 weeks 100% paid parental leave for the primary caregiver and 6 weeks 100% paid leave for the secondary.
- Wellness: Dedicated monthly wellness events to promote physical and mental well-being.
- Exec coaching & mentorship: Extensive leadership coaching and mentorship offered through the year.
- Own a piece of VTS: Be an owner of the company you’re building with our equity packages.
- Never stop learning: VTS regularly hosts informal education sessions and provides an allowance for external courses.
Company HQ
Midtown South, New York, NY
Leadership
Nick Romito
(Co-Founder & CEO)Started his career in commercial real estate over a decade ago as a tenant rep and landlord broker at New York City’s Murray Hill Properties. Then went on to AM Properties before becoming the founder and CEO of Titan Advisors in 2009. Founded VTS in 2010.
Ryan Masiello
(Co-Founder)Started his career at Cushman & Wakefield, before getting recruited by JLL to help lead the firm’s business development efforts in New York, eventually becoming Senior Vice President.
Niall Smart
(Co-Founder & CTO)Previously co-founder and CTO at Hightower, and earlier was co-founder of Echodio, a Y-Combinator backed digital media startup that was acquired by RealNetworks in 2009.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 11 more jobs at VTS