[Remote] Senior Security Engineer
Note: The job is a remote job and is open to candidates in USA. Credit Sesame is hiring a Senior Security Engineer to own end-to-end security for its platform. The role covers security reviews, cloud and application security, incident response, compliance controls, security automation, and threat modeling of AI/LLM systems.
Responsibilities
- Run security reviews for new tools, vendors, and projects — data handling, AI usage, DPAs, PII, authentication/authorization, and third-party security reports (SOC 2, PCI, ISO, pentest results)
- Own access and infrastructure security — IAM least-privilege reviews, S3/database access controls, environment segregation, service-to-service authentication, and network configuration audits (VPC flow logs, inbound/outbound rules)
- Run vulnerability management across cloud and endpoints, and manage IDS/IPS (e.g., Palo Alto Panorama, AWS WAF) and EDR/MDR tooling
- Lead security incident response end to end — triage, investigate, contain, document, and build the runbooks as you go
- Implement and maintain the technical controls supporting our PCI DSS and SOC 2 / ISO 27001 compliance programs, including internal audits, risk metrics, and disaster recovery planning
- Partner with DevOps/IT on patch management and secure infrastructure defaults, and present tooling and risk recommendations to engineering leadership
- Build our in-house AppSec scanning program — evaluate and pilot SAST/SCA/IaC tooling (Semgrep, Trivy, Upwind), integrate into GitLab CI and Jenkins, define severity-based remediation SLAs, and drive rollout across services
- Build internal security tooling and automation — custom scripts and integrations (Python/boto3, APIs) that pull data from tools without native integrations into shared dashboards and reports
- Build and tune detection pipelines — for example, feeding traffic/bot-protection alerts (Datadome) into our log platform (ELK/Kibana) and writing rules that catch real attack patterns
- Threat-model and pentest our AI/LLM systems — scope risks like prompt injection and data exfiltration through MCP servers, coordinate external pentests where needed, and drive remediation
- Maintain security policies and practices and drive training and adoption throughout the company
Skills
- You have 7+ years of hands-on security engineering experience across application security, cloud security, and network/penetration testing — not just one lane
- You've driven tooling or architecture decisions independently (evaluated options, made the call, defended it to leadership)
- You're self-directed, pragmatic, and ruthless about prioritization
- You've built production automation from scratch — API integrations, custom collectors, or internal tooling — not just one-off scripts
- You have hands-on experience deploying and running OSS security tools — Burp Suite Community/OWASP ZAP, Nmap, Nuclei, Metasploit, Semgrep, Trivy, Wazuh/OSSEC, ELK/Kibana, Prowler/ScoutSuite, HashiCorp Vault, or similar
- You have solid AWS security experience
- You have working knowledge of PCI DSS, SOC 2, and ISO 27001 — enough to implement controls and support audits
- You're curious about emerging security domains and comfortable threat-modeling systems (like AI/LLM applications) that don't have an established playbook yet
- You're an excellent communicator who can translate cost/coverage tradeoffs and technical risk for both engineers and executives
- BS in Computer Science or related field, or equivalent hands-on experience
- OSCP, GPEN, or similar certifications
- Bug bounty experience
- Prior experience at a startup
- Experience securing LLM/AI-based systems
Benefits
- Equity in a pre-IPO company backed by top VCs
- Comprehensive medical, dental, and vision insurance
- Monthly home office stipend
- Professional development program to support your continued growth
- Flexible paid time off
- 10 paid holidays and 6 additional Sesame Wellness days
- A culture that emphasizes total wellness, including work-life harmony
Company Overview
Company H1B Sponsorship