Security Engineer, Vulnerability Management

LiveKit is hiring a Security Engineer to build and run its vulnerability management and security operations program. The role owns vulnerability scanning, triage, remediation workflows, reporting, and automation, while partnering with engineering and compliance teams.

Responsibilities:

• Select, deploy and operationalize scanning tooling across our production assets
• Run vulnerability management end to end: triage, severity in our environment, owner assignment, remediation SLAs and reporting
• Build engineering-first triage and remediation workflows that fit how our engineering teams already work, and automate the routing and follow-up
• Build a remediation dashboard that engineering and leadership read and act on
• Automate collection of the vulnerability management evidence our compliance programs depend on, in partnership with our Compliance team
• Build automation, including agentic tooling, that removes manual security operations work and keeps pace with engineering growth

Requirements:

• think like both a builder and a breaker, and understand security from first principles
• take an automation-first and pragmatic approach to risk mitigation
• translate security concerns into engineering action
• can clearly explain complex technical concepts to others
• are a fast learner and thrive in ambiguity
• 5+ years in security engineering, security operations or software engineering, with a significant share of that focused on security
• Hands-on experience building or running a vulnerability management program or software security tooling (SCA, container, cloud or host scanning)
• An engineering-first approach to triage and remediation: you get findings fixed by making the fix easy to ship
• The judgment to set a finding's real severity in our environment, using CVSS as one input
• Strong scripting and automation skills in a language such as Go or Python, and comfort reading infrastructure as code such as Terraform
• A pragmatic approach to risk: you can explain why a finding matters to the business and how fast it needs to be fixed
• Experience with real-time media, networking or WebRTC systems
• Experience supporting compliance audits such as HIPAA, PCI-DSS, ISO 27001 or SOC 2
• Incident response or application security experience
• Experience in AI security, such as securing LLM applications or agent infrastructure