Sr. Security Engineer

C1 is an AI-native identity security platform that protects human, non-human, and AI identities through automation, access visibility, fine-grained controls, and access reviews. The Senior Security Engineer will support security engineering, application and cloud security, and compliance by building security automation, embedding risk-based practices into the development lifecycle, leading threat modeling, and partnering with engineering teams on remediation.

Responsibilities:

• Define and drive security standards and secure-by-default solutions, serving as a subject matter expert for application and/or cloud security
• Build purpose-built agents and skills that orchestrate security into the development lifecycle through a risk-based approach, automating the manual, repetitive work (triage, enrichment, review) so the team can focus on judgment calls, not queues
• Shift security left by baking risk-based review into design specs and architecture decisions, rather than relying on post-deploy audits to catch issues
• Build security tooling and automation that scales security practices across engineering, and help implement meaningful, actionable security observability and detection signals
• Lead threat modeling and risk assessment for high-risk features and platform changes
• Assess and help mitigate security risks introduced by agentic development practices and AI-powered product features running in production
• Partner with engineering teams to prioritize and remediate critical threats, help define API security standards, and conduct security code reviews
• Continuously explore and adopt open-source tools to assess the security of and test our services, rather than defaulting to manual review
• Identify systemic security risks and lead multi-team remediation efforts end-to-end, not just the initial recommendation
• Partner across security, compliance, and engineering on cross-domain problems — be a go-to point of contact when a hard security question needs clarity
• Contribute to compliance and trust initiatives (e.g., SOC 2, ISO 27001/42001) as they intersect with your area of focus
• Invest in the growth of teammates and in raising the security bar across the broader engineering org

Requirements:

• Proven experience securing enterprise SaaS applications, including authentication flows, authorization patterns, and input validation at API boundaries
• Demonstrated experience securing deployment and change-management mechanisms for software and infrastructure
• Background in Software Engineering, Platform Engineering, Systems Engineering, Network Engineering, Cloud Security, or Application Security
• Hands-on code review experience, ideally in Go, Python, or Rust
• Experience with AWS (or another major cloud provider) and comfort working across cloud infrastructure
• Comfortable working both independently and collaboratively in a fast-paced, high-growth environment
• Curious and current on modern security practices, tooling, and emerging threats, including how AI is changing the threat landscape
• Someone to participate quarterly in-person in one of our primary offices San Francisco, or Portland Oregon
• A project, demo, or repo where you built an agent, skill, or automation that replaced manual security work (triage, review, detection, etc.)
• Examples of how you use AI coding tools or agentic workflows in your day-to-day work
• A short walkthrough - live or recorded - of a security automation you shipped, including the problem, your approach, and the impact
• Experience with Kubernetes, service mesh, or PKI/network technologies (Consul, Envoy, Cilium, Vault, Istio, etc.)
• Experience building or extending internal security tooling, automations, or agents
• Prior experience at a high-growth SaaS or identity/access management company