Senior Security Engineer

queueinc • Newark, CA

8d • Hybrid

About The Position

Queue builds robots to fill prescriptions. Our machine is designed to take stock bottles of medication and produce counted, labeled vials, so that pharmacists and technicians can spend their time on patients. Our first product is built to work behind the pharmacy counter and to be operated by pharmacy staff.

You own security engineering for a pharmacy robot and everything it talks to: the machine, its operating-system image, the software that runs on it, the cloud service that commands it, and the path that updates it. When a customer asks how each machine proves its identity, who can reach it and how, and what an independent test found and what was done about it, the answer rests on your work, and every statement in it is backed by something the system produces.

Requirements

• Ownership of the security of a shipped product end to end, with the ability to describe a problem found, fixed, and followed until it remained fixed.
• Ability to read and write code, with deep skill in Rust, TypeScript, or Python, and comfort reading the others.
• Proficiency in systems and network security, including TLS and certificates, identity and access management, secrets management, and Linux hardening.
• Ability to reason about trust boundaries from hardware to the cloud.
• Offensive fluency with defensive judgment, including experience running or working closely with penetration tests.
• Ability to rank issues by their potential impact on the system and users, and to defend decisions to defer issues.
• Experience with threat modeling that engineers find useful and engaging.
• Precise writing skills to state facts accurately and with appropriate strength of evidence for engineers, executives, or customer assessors.

Nice To Haves

• Device security experience, including verified start-up, hardware-held keys, signed updates, and fleet identity.
• Experience in security within healthcare or another regulated industry.
• Experience with customer security reviews from the supplier's perspective.
• Cloud security engineering experience on AWS.
• Knowledge of supply-chain security, including dependency policy, artifact signing, and provenance.
• Working knowledge of IEC 62443, UL 2900-1, or NISTIR 8259.

Responsibilities

• Develop and maintain the threat model, including trust boundaries for machine to cloud, operator to screen, update path, remote support, and suppliers.
• Conduct security reviews of designs early in the process and ensure reviews are recorded.
• Own device identity and key custody, including priorities and verification, collaborating with operating-system image engineers.
• Manage independent security testing, including scoping, test environment setup, triage, remediation with owning squads, and retesting.
• Oversee the process for finding, triaging, and fixing weaknesses in code, dependencies, device images, and cloud infrastructure, setting rules and tracking findings to closure.
• Lead the security aspects of incident response, including detection, triage, containment, evidence gathering, and implementing post-incident changes, in collaboration with Systems Reliability Engineers.
• Review customer security statements against evidence such as versioned implementation, deployed configuration, and operational records, ensuring accuracy and substantiation.
• Manage cloud security posture, including identity and access, secrets management, review of infrastructure changes, and monitoring cloud provider detection services.
• Verify security and privacy controls, including those related to HIPAA, and collect evidence directly from the system.
• Assess security risks and make recommendations, ensuring that any accepted risks are formally recorded with approvers, conditions, and authorized business owner acceptance.

Benefits

• Ownership of security engineering for the machine and its connected systems.
• Opportunity to work on challenging problems including trust boundaries, device identity, key custody, and update paths.
• Work in a small team environment with minimal bureaucracy and high trust.
• Significant autonomy and influence, reporting to the Head of Software Engineering.
• Direct impact by checking every security statement against evidence before it goes to a customer.
• Growth opportunities through design review, independent testing, and retesting.
• Collaboration with engineers building on-machine software, cloud services, and operating-system images.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed