Staff Security Engineer

Order.co is the System of Action for the Office of the CFO, transforming the way businesses purchase and pay into an intuitive, B2C-like shopping experience. The Staff Security Engineer will own technical direction and execution of security initiatives that protect company data and improve systems security, driving impact across multiple teams or systems.

Responsibilities:

• Own Platform team-level architectural security decisions; research, design and own security frameworks, evolution paths, and technical debt strategy while others build against your direction
• Lead and contribute to large, complex security initiatives; decompose work, coordinate execution, and surface risks before they become incidents
• Proactively detect and remediate security vulnerabilities with discernment using AI tooling as an accelerant while applying rigorous judgment on correctness and risk
• Champion security standards, testing patterns, and observability; driving improvements in security beyond your immediate team by embedding security in the software development lifecycle and infrastructure changes
• Mentor senior engineers toward Staff-level behaviors; your impact compounds through the engineers you develop, not just the code you write
• Align multiple teams on security strategy; translate business goals into secure system design and represent security strategy in organizational discussions

Requirements:

• Own Platform team-level architectural security decisions; research, design and own security frameworks, evolution paths, and technical debt strategy while others build against your direction
• Lead and contribute to large, complex security initiatives; decompose work, coordinate execution, and surface risks before they become incidents
• Proactively detect and remediate security vulnerabilities with discernment using AI tooling as an accelerant while applying rigorous judgment on correctness and risk
• Champion security standards, testing patterns, and observability; driving improvements in security beyond your immediate team by embedding security in the software development lifecycle and infrastructure changes
• Mentor senior engineers toward Staff-level behaviors; your impact compounds through the engineers you develop, not just the code you write
• Align multiple teams on security strategy; translate business goals into secure system design and represent security strategy in organizational discussions
• You measure success by the team's security posture and system health, not your own contributions alone
• You self-direct technical improvement work beyond the product roadmap. You identify what needs to change and drive it without waiting to be asked
• You develop others. Your presence makes engineers around you more effective and higher-scope
• You've owned production systems at scale and made security trade-offs under real constraints
• Proficiency in Ruby on Rails and PostgreSQL, including understanding the framework's security tools (Active Record encryption, CSP, sanitization, asynchronous background processing)
• Hands-on security experience with AWS, infrastructure as code, and CI/CD at scale
• Expert-level knowledge of network security, operating systems (Linux), and cloud platforms
• Experience with NIST, ISO27001, CIS MITRE ATT&CK, CSA CCM, SOC2, GDPR frameworks
• Strong track record with cloud security, API security, secure software development, threat modeling, identity and access management, network segmentation, vulnerability management, incident response, and compliance-driven security controls