Senior Security Engineer - Data Security

Root Inc. is an insurance technology company working to create improved insurance experiences through world-class technology and risk management. The Senior Security Engineer will lead the Data Security domain by defining strategy, standards, controls, and risk priorities for protecting sensitive data across its lifecycle. The role partners with data, engineering, analytics, security operations, and GRC teams to implement secure patterns, automate workflows, and improve data security maturity.

Responsibilities:

• Help establish the data security strategy and roadmap for sensitive policyholder, customer, employee, and corporate data
• Protect PII, financial information, health-related information where applicable, claims data, and other regulated or confidential data across its full lifecycle
• Establish standards for data classification, encryption, key management, masking, tokenization, anonymization, pseudonymization, retention, deletion, and secure data sharing
• Design and improve data access governance, including least privilege, RBAC/ABAC, privileged access, row-level controls, column-level controls, and periodic access reviews
• Partner with Data Platform and Analytics teams to embed security controls into data pipelines, warehouses, data lakes, reporting platforms, and machine learning workflows
• Improve visibility into sensitive data stores, data flows, third-party transfers, and access patterns through discovery, monitoring, DLP, and related security tooling
• Establish secure backup, recovery, and resilience requirements for critical data
• Translate regulatory and business requirements into practical technical controls and measurable risk-reduction initiatives
• Lead cross-functional prioritization, balancing urgent risk remediation with long-term data security maturity and SOC 2 readiness
• Automate security workflows using scripting, APIs, policy-as-code, and approved AI-assisted tools while protecting confidential and regulated information
• Develop playbooks, reference architectures, and reusable patterns that improve consistency and reduce operational overhead
• Participate in the Security Engineering on-call rotation, triaging alerts and security issues during business hours and responding to after-hours escalations as needed
• Communicate data security risks, decisions, and recommendations clearly to engineers, business stakeholders, and senior leadership
• Coach engineering and analytics teams on secure data handling and help raise the organization’s overall data security maturity

Requirements:

• • 5+ years of experience in data security, cloud security, security engineering, privacy engineering, or a related technical field
• • Hands-on experience securing sensitive data in cloud environments and applying controls across storage, processing, analytics, and data-sharing systems
• • Experience with several of the following: IAM, RBAC/ABAC, encryption, KMS/HSM, data classification, DLP, data discovery, access reviews, tokenization, masking, retention, deletion, backup security, and audit logging
• • Demonstrated experience embedding security requirements into data platforms, data pipelines, analytics workflows, or application architectures
• • Experience working with engineering, data platform, analytics, infrastructure, Security Operations, Privacy, Legal, or GRC teams
• • Experience improving security operations through automation, scripting, integrations, policy-as-code, or systematic process improvement
• • Familiarity with applicable privacy, security, and regulatory requirements, such as HIPAA, GLBA, state privacy laws, NYDFS, PCI DSS, NIST, or similar frameworks, where relevant
• • Strong communication skills, including the ability to explain technical risks and tradeoffs to both engineers and senior leadership
• • Demonstrated ability to balance security requirements with business needs and build alignment across stakeholders
• • Sound judgment when using approved AI-assisted tools with confidential, proprietary, or regulated information
• • Experience in insurance, financial services, healthcare, or another regulated industry
• • Experience with data security posture management, data activity monitoring, enterprise DLP, or cloud data security platforms
• • Familiarity with major cloud providers and cloud-native data services
• • Experience with infrastructure-as-code, CI/CD security, policy-as-code, or security automation
• • Experience supporting SOC 2, HIPAA, GLBA, NYDFS, PCI DSS, ISO 27001, or similar compliance programs
• • Familiarity with AI-assisted engineering tools such as GitHub Copilot, Claude, Codex, or comparable platforms