Note: The job is a remote job and is open to candidates in USA. Lob is transforming the way businesses use direct mail through technology and is seeking a Staff Security Engineer to lead their security engineering efforts. This role involves owning the engineering side of security, including cloud infrastructure, application security, and incident response, while collaborating with various teams to enhance security practices.
Responsibilities
- Security posture of our AWS environment, including our CNAPP program and cloud misconfiguration risk
- Security review of infrastructure changes across Terraform, Nomad, and our Cloudflare edge
- WAF strategy and tuning at the domain level
- Working with Platform engineers so security is designed in rather than reviewed at the end
- Build and own our detection engineering practice on our SIEM, moving us from noisy alert channels to curated, high signal detections
- Define alert triage ownership, runbooks, and severity criteria
- Own security incident response: escalation paths, tabletop exercises, post incident reviews
- Partner with IT on endpoint detection and endpoint vulnerability coverage
- Own the vulnerability management program across SCA, SAST, DAST, and container scanning
- Manage and mentor our application security contractor, and route remediation work into engineering teams effectively
- Threat modeling and security architecture review for new products and major changes
- Improve secure SDLC practice in a high velocity, AI-assisted engineering org
- Technical ownership of our annual independent penetration test: scoping, findings triage, remediation routing, retest coordination
- Produce the technical evidence our GRC counterpart needs for SOC 2, HIPAA, and Microsoft SSPA, without owning the audit itself
- Build tooling and automation rather than process and spreadsheets
- Apply AI to security operations where it creates real leverage
Skills
- 8 or more years in security engineering, with meaningful depth in cloud security
- Hands on expertise with AWS security services, IAM design, and infrastructure as code
- Demonstrated detection engineering experience: you have written detections, tuned them, and cut false positive rates
- Real incident response experience as a responder or lead, not just as a plan author
- Fluency in application security sufficient to review findings, judge severity, and argue exploitability with engineers
- Track record of shipping security improvements through other teams by earning trust rather than filing tickets
- Comfort as the senior technical security voice in an organization without a large security team
- Experience supporting SOC 2 Type 2, HIPAA, or Microsoft SSPA from the engineering side
- Container and orchestration security, particularly Nomad or Kubernetes
- Cloudflare, including Zero Trust and WAF
- Experience in a company handling regulated or consumer-identifiable data at scale
- Prior experience mentoring or managing engineers or contractors
Benefits
- RSUs
- Remote working opportunities in AZ, CA, CO, DC, FL, GA, IA, IL, MA, MD, MI, MN, MT, NE, NC, NH, NJ, NV, NY, OH, OR, PA, RI, TN, TX, UT, and WA, unless specified otherwise in the job description above.
Company Overview
Company H1B Sponsorship