Principal Compliance & Security Engineer

MrBeast • San Mateo, CA

10d • Hybrid

About The Position

Beast Industries is hiring a principal-level individual contributor to establish and own security architecture and technical compliance across Step, Feastables, and the media organization. The company is undertaking an AI-first engineering rebuild, creating an opportunity to build its security and compliance foundation without legacy constraints. The role focuses on enabling regulated products to ship quickly while protecting payment systems, consumer and supply-chain data, and information related to minors.

The position bridges security engineering and compliance engineering. It will establish a unified control framework mapped to PCI DSS, COPPA, GDPR/CCPA, and SOC 2, and make compliance continuous through automated evidence collection and control monitoring. The engineer will set security standards and secure-by-default patterns, lead security reviews and incident response, manage vulnerabilities, support audits, and advise leaders on risk tradeoffs.

Requirements

• Around 15 years of combined security engineering and compliance experience.
• Proven ownership of PCI DSS and SOC 2 in production, from control design through a successful audit.
• Strong cloud security experience with AWS and/or GCP.
• Strong application security, threat modeling, and incident response skills.
• Ability to read and reason about code.
• Working knowledge of privacy and minor-protection regulations, including COPPA, GDPR, and CCPA, and how they map to technical controls.
• Daily use of AI and ability to apply it in security work where useful, including automation and evidence pipelines.
• Ability to communicate risk clearly, make and explain risk-based decisions, and influence through evidence.

Nice To Haves

• Fintech or payments experience, including money movement or KYC.
• Experience with security automation and infrastructure-as-code, including Terraform or policy-as-code.
• Relevant certifications such as CISSP, CCSP, or OSCP.
• Experience establishing a security or compliance function at an early-stage organization.

Responsibilities

• Own security architecture and the technical compliance posture across Step, Feastables, and the media organization.
• Build a unified control framework with each control mapped to applicable regulations and frameworks, including PCI DSS, COPPA, GDPR/CCPA, and SOC 2.
• Automate evidence collection and control monitoring to make compliance continuous.
• Set security standards for cloud infrastructure, applications, and data systems.
• Lead threat modeling and security reviews for high-risk products, especially Step payment and account systems and systems that handle minors' data.
• Run the vulnerability management program and drive remediation to closure with system-owning teams.
• Build and own incident response, including detection, playbooks, escalation, post-incident reviews, and breach-notification readiness.
• Act as technical lead during PCI DSS and SOC 2 audits and represent Beast Industries with auditors, regulators, and partners.
• Translate regulatory requirements into actionable engineering work and advise leaders on risk tradeoffs.
• Define secure-by-default patterns and paved paths that help teams meet requirements without one-off reviews.

Benefits

• Highly competitive equity package.
• Competitive salary.
• Medical, dental, and vision insurance.
• Company-paid life insurance.
• Company contributions to employee Health Savings Accounts (HSA).
• 401(k) plan with Safe Harbor company matching.
• Flexible vacation policy and paid company holidays.
• Company-provided technology package.
• Relocation assistance where applicable, including travel and company-provided housing for the first 90 days.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal
• Education Level: No Education Listed