Senior/Staff Security Engineer, Sage

• 6+ years of experience in security engineering, with demonstrated depth in cloud security (at least one of AWS or GCP required)
• Hands-on experience with IAM design, VPC architecture, security group management, and infrastructure hardening in production environments
• Experience building or significantly improving vulnerability management programs, including tooling selection, integration, and triage workflows
• Direct experience with SOC 2 and HIPAA compliance, including evidence collection, control implementation, and auditor interactions
• Practical incident response experience: you have detected, investigated, and resolved real security incidents, not just written the plan
• Experience securing containerized applications and CI/CD pipelines
• Experience securing device or edge computing environments, including firmware updates, device authentication, and network security for IoT or embedded systems
• Strong written and verbal communication skills. You can explain a risk finding to an engineer and a business stakeholder in the same day
• Willing and excited to be in the office Tuesday through Thursday (NYC)

Desirable

• We are looking for a Senior/Staff Security Engineer to own and advance the security posture of our platform as we scale
• You will be the dedicated security practitioner on the engineering team, responsible for hardening our cloud and edge infrastructure, driving compliance programs, building vulnerability management and incident response capabilities, and embedding security into the software development lifecycle
• This is a hands-on individual contributor role reporting to the Engineering Manager of Cloud and Security
• You will work across AWS and GCP environments, partner closely with product engineering and platform teams, and have direct impact on Sage's ability to earn and maintain customer trust
• Success in this role requires deep technical security skills, comfort operating across a broad surface area, and a bias toward practical, risk-proportionate solutions over checkbox compliance
• Harden and continuously improve the security of Sage's cloud infrastructure across AWS and GCP, including IAM policies, VPC configurations, security groups, and network segmentation
• Own vulnerability management end to end: implement scanning, triage findings, coordinate remediation with engineering teams, and track resolution. Drive penetration test findings to closure on defined timelines
• Build and maintain incident response capabilities, including detection tooling, runbooks, and post-incident analysis
• Drive Sage's SOC 2 and HIPAA compliance programs forward, producing evidence, closing control gaps, and coordinating with external auditors
• Implement and operate supply chain security controls, including dependency scanning, credential leak monitoring, and secret rotation automation
• Embed security into CI/CD pipelines and the software development lifecycle through automated checks, secure defaults, and developer education
• Conduct security reviews of architecture decisions, new services, and third-party integrations. Own the vendor security assessment process for evaluating and tracking third-party risk
• Establish and maintain key and credential rotation policies with clear ownership and audit trails
• Implement automated compliance scanning across cloud accounts and projects with defined triage workflows
• Validate that disaster recovery procedures maintain security controls through failover, including encryption, access control, and network segmentation
• Partner with engineering, product, and executive stakeholders to communicate security risk clearly and advocate for proportionate investment