Senior Security Engineer, Vulnerability Management

Responsibilities

• Lead end-to-end response to product security incidents, from discovery and triage through remediation and disclosure.
• Own and evolve the Product Security Incident Response Team (PSIRT) function, including incident classification frameworks, severity models, escalation paths, and response playbooks.
• Drive coordinated vulnerability disclosure (CVD) processes and partner with bug bounty programs and external security researchers.
• Coordinate Product Security, Engineering, Legal, Communications, and Customer Success during active security incidents.
• Lead post-incident reviews and translate findings into systemic improvements across products, processes, and detection capabilities.
• Develop and maintain incident response tooling, automation, and reporting to reduce time to detect and respond.
• Contribute to customer-facing security advisories, CVE disclosures, and public incident communications.
• Evaluate and integrate AI-powered tooling and workflows for incident detection and response.
• Mentor other engineers and help mature product security and incident response capabilities.
• Participate in an on-call rotation with out-of-business-hours coverage.

Requirements

• 5+ years of career experience in IT or Engineering with a security focus.
• Hands-on experience leading or participating in security incident response, ideally in a product or SaaS company.
• Experience with coordinated vulnerability disclosure and external security researcher relationships.
• Strong judgment under pressure and the ability to make clear, defensible decisions with incomplete information.
• Experience building or formalizing incident response capabilities, including playbooks, runbooks, severity frameworks, and escalation processes.
• Experience drafting or contributing to customer security advisories, CVEs, or public-facing incident communications.
• Strong communication skills across engineers, executives, and customers.
• Ability to read and write code for forensic analysis, automation, and tooling.
• Adaptability and resilience in a fast-paced environment.
• Experience using AI/ML capabilities to accelerate security workflows, automate repetitive tasks, or improve detection and response.

Nice-to-haves

• Familiarity with CVSS, EPSS, and vulnerability severity frameworks.
• Experience in a consumer or B2B SaaS environment where customer trust and public perception are high stakes.
• Familiarity with Software Bill of Materials (SBOMs) and supply chain risk.
• Experience with SOC 2, ISO 27001, and incident reporting obligations.
• Certifications such as GCIH, GCFE, GCFA, PNPT, or similar.
• Experience building AI-powered security workflows and explaining their downstream impact.

Compensation and Benefits

• USA-based roles: annual base salary of $153,000 USD to $214,000 USD, plus health, dental, 401(k), paid time off, equity, and applicable incentive programs.
• Canada-based roles: annual base salary of $144,000 CAD to $202,000 CAD, plus health, dental, RRSP, paid time off, equity, and applicable incentive programs.