materialsecurity - Sr. Corporate Security Engineer
Requirements
• Operator Depth: 6+ years in corporate or enterprise security or detection and response, with hands-on ownership of a SIEM, detection content, and incident response. • Software Engineering: Comfortable in Python, Go, or TypeScript working directly against vendor APIs. You automate enforcement rather than configuring it by hand. • Identity Fundamentals: Deep understanding of OAuth, SAML/OIDC, session and token lifecycle, and how identity reaches cloud IAM. • Endpoint Fluency: You have managed a Mac fleet with a modern MDM and EDR and taken it from deployed to enforced. • Applied LLM Judgment: You have built or seriously experimented with LLM-driven workflows, including prompting, tool use, and evaluation, and can explain how you would know whether one is doing a good job. • Software Development (nice to have): You have contributed detection logic or security features to a product codebase and are comfortable working inside an engineering team's review and release process. • How You Work: Collaborative, curious, direct. You work well next to more junior engineers without taking over, and you would rather engineer a problem away than staff it. • Material Security is a remote-first workplace with an office in San Francisco, California. • By clicking "Apply for this Job", you acknowledge that you have read the California Candidate Privacy Notice Regarding Use of Personal Information https://material.security/ccpa and hereby agree to its terms.
Responsibilities
• Detection and Response (own): Own corporate telemetry and the detection content on it. Close coverage gaps, reduce noise with measured fidelity, and build detections for what matters here: account takeover, session token theft, malicious OAuth grants, admin abuse, and exfiltration by someone who legitimately has access. Lead corporate incident response and own the playbooks. • LLM-Driven Triage (own): Design and build the agent that reviews privileged access grants, customer data access, and high-fidelity endpoint and identity alerts in near real time, with labeled evaluation sets, measured precision and recall, explicit limits on automated action, and a defense against being steered by log content or an employee's reply. • Endpoint (shared with the CorpSec team): Device management and endpoint detection for the Mac fleet. Automate update enforcement, deepen EDR coverage, bring browser-level DLP to the fleet, and enforce BYOD posture on iOS and Android. • Identity and SaaS (shared with the CorpSec team): The identity provider and the SaaS estate. Maintain phishing-resistant authentication everywhere, address the applications that cannot do SSO, automate access-review evidence, and turn manual vendor and OAuth application review into a pipeline. • Google Workspace (shared with the CorpSec team): Admin alerting, OAuth governance, Apps Script governance, sharing, and DLP, using our own product where it fits. Partner with Engineering to propose, test, and ship detection updates to the product based on what you see in our own tenant. • Corporate to Production (shared with AppSec): The boundary between corporate and production: detections that cross it, just-in-time access, and the logging that shows who touched what.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT