Staff Security Engineer, EvenUp

• 10+ years of implementation experience in a security-focused role with an emphasis on hands-on secure technical architecture and implementation work, and oversight in a team setting (e.g., conducting solution security reviews)
• Proven expertise in SAST/DAST, application security, and CI/CD pipeline integration
• Deep understanding of AI-specific threats — prompt injection, model poisoning, membership inference, adversarial perturbation, and output manipulation
• In-depth knowledge and implementation experience of information security principles, policy enforcement, operating systems, web application security, and a high-level of familiarity with malicious code uses, OWASP Top 10, and common techniques used by hackers
• Experience with designing and implementing next-generation security technologies, such as SASE, CASB, or RASP
• Hands-on experience with application patch management, software supply chain security, or artifact repositories like JFrog and Snyk
• Strong fluency in at least one programming or scripting language: Python, Ruby, NodeJs
• Cybersecurity certification (e.g. CISSP, CISM, CISA, CRISC, GIAC or other relevant certification)
• Up-to-date knowledge and regular monitoring of the evolution of technologies and vulnerabilities to identify the solutions and measures necessary to secure cloud computing applications and ecosystems
• Hands-on and in-depth experience with application and infrastructure-level design security including modern mitigation techniques and good practices (e.g., DNS-SEC, OWASP Top 10 mitigations, cryptographic fundamentals etc.)
• Strong hands-on skills with creating automations using Python

Desirable

• Today, our engineering team is roughly ~100 people, but by the end of 2026 we’ll roughly double the size of the team
• With our growth, we’re looking for a strong Staff Security Engineer to work cross-functional and manage our security within our infrastructure team
• We need a hands-on Staff Security Engineer to lead our Security efforts and drive our growth. You’ll help us evaluate building vs buying security solutions
• Risk Management: Identify and address security risks through thorough assessments and mitigation strategies
• Code and Network Security: Ensure the secure coding of the platform and implement measures to protect against unauthorized access and data breaches
• Incident Response: Develop and execute plans to respond to security incidents, conducting forensic analysis and implementing preventive measures
• Compliance and Ethics: Ensure EvenUp systems comply with regulations and industry standards, addressing ethical concerns and promoting transparency
• Continuous Monitoring: Establish real-time monitoring systems to detect and respond to security threats, conducting regular assessments
• Vendor and Third-Party Security: Assess and secure third-party components integrated into our systems to prevent vulnerabilities
• Security Training: Provide training to enhance the team's security awareness and foster a security-conscious culture
• Documentation and Reporting: Maintain documentation of security protocols, incidents, and improvements, and communicate regular reports to stakeholders