Senior Security Engineer

Bird is seeking a Senior Security Engineer to join its security team. The role is a hands-on position responsible for penetration testing, vulnerability management, cloud and corporate security, monitoring and detection, customer-facing security features, endpoint security, abuse prevention, and security automation.

Responsibilities:

• Hack our platforms and products: pentest new features and products before they ship, and help run our vulnerability management program end-to-end — triaging findings from bug bounty, scanners, and pentests, and often fixing them yourself rather than handing them off
• Harden our cloud environments: raise the security posture of our AWS organisations with preventative guardrails and detective controls (think SCPs, IMDSv2 enforcement, GuardDuty), and keep our internet-facing attack surface continuously mapped, scanned, and shrinking
• Run and improve security monitoring and detection: build and tune detections, handle alerts, and act as a technical incident handler when something real happens
• Secure our corporate environment: SaaS application security, identity and access management, Okta, and Google Workspace hardening
• Build customer-facing security features alongside our engineering teams — SSO, MFA improvements, SCIM, audit logging, and session controls for our enterprise customers
• Contribute to endpoint and device security (MDM, device lifecycle, endpoint hardening) — the security team owns IT at Bird, and everyone shares in it
• Detect and prevent abuse and fraud on our platforms
• Build security automations, increasingly with AI and LLMs - we'd rather automate a task than staff it
• Take a rotating turn as the team's operational point of contact for access requests, security questions, and IT support - everyone shares the operational load, and we keep automating it down

Requirements:

• 3+ years of hands-on experience in technical security roles - penetration tester, incident responder, security engineer, or similar
• You can script and automate in at least one major language and are comfortable reading code you didn't write
• Deep technical curiosity: you take things apart to understand them, and you're drawn to problems beyond whatever your current role says you own
• Comfort operating without a playbook: when you hit an unfamiliar problem, you work out a sound path forward instead of waiting for a defined process - and when something is material enough to escalate, you bring a recommendation, not an open question
• A bias to done: thorough and organised, but you'd rather ship a good fix today than a perfect one next sprint. Blockers are things you clear, not things you report
• You already use AI tooling as a serious force multiplier in your day-to-day work and want to push it further
• Clear communication with engineers, leadership, and customers - you can explain the same vulnerability to the engineer fixing it and to an enterprise customer's security team
• You've shipped production code - the feature-development side of this role goes deeper if you have
• Cloud security depth in AWS (IAM, organisation-level controls, GuardDuty) or Kubernetes security
• Hands-on experience with Okta, MDM platforms (e.g. Jamf), or SIEM and detection engineering
• A public security track record: bug bounty findings, CVEs, CTF placements, open-source tooling, or published research
• Experience building with LLMs - agents, security automation, or internal tooling