Senior Security Engineer

We’re a ~40 person company building the OAuth/OpenID Connect platform that large digital banks and regulated industries run their identity on. Our stack is Java on Google Cloud, delivered as a shared multi-tenant service, dedicated single-tenant clusters, and a self-managed product customers run themselves. This is a hands-on builder role, not a management or pure-compliance role. You’ll build our security program from the ground up: writing the policies, shipping code fixes, wiring detection into GCP, and setting the practices the rest of engineering follows. You’ll lean on AI to move fast, researching how the best companies do this, drafting policies, reviewing code, and hunting vulnerabilities at a scale a lean team otherwise couldn’t reach. What you'll do Stand up our vulnerability management program end to end: intake, triage, severity, remediation targets, security advisories, and coordinated disclosure, across both our managed and self-managed deployment models. Build our product security incident response (PSIRT): on-call, playbooks, and AI-assisted triage that turns High/Critical CVEs into paged incidents automatically. Work hands-on in the codebase, contributing security fixes to our Java platform and raising the bar on secure coding, secrets and key management, and hardening. Build proactive detection and response in GCP: alerts, monitoring, and automation where it pays off. Integrate security into CI/CD and IaC: dependency and container scanning, Terraform checks.