Senior Security Engineering Manager, Product Security

Upstart

5d•$190,600 - $263,900•Remote

About The Position

Upstart is seeking a Senior Security Engineering Manager for Product Security to lead a team responsible for scaling security engineering practices across application security, infrastructure security, offensive security, and product security. This role involves setting priorities, developing team members, and partnering with senior engineering and business leaders to shape Upstart’s security engineering strategy, strengthen secure-by-design practices, reduce systemic risk, and improve the security posture of customer-facing products, cloud-native services, internal platforms, APIs, and AI-driven product workflows. Upstart is a digital-first company with a mission to reduce the cost and complexity of borrowing. They partner with banks and credit unions to expand access to affordable credit through AI. The company offers flexibility with most employees working remotely, with intentional in-person connection opportunities.

Requirements

8+ years of experience in security engineering, software engineering, infrastructure engineering, offensive security, product security, or related technical security roles.
3+ years of experience managing, leading, or formally developing security engineers or technical teams.
Experience leading security engineering programs in at least two of the following domains: application security, infrastructure security, offensive security, product security, cloud security, or secure SDLC.
Experience partnering with Engineering, Product, Infrastructure, Risk, Compliance, or Audit stakeholders to deliver cross-functional security initiatives.
Experience with modern application and infrastructure architectures, including APIs, web applications, cloud-native services, CI/CD pipelines, identity and access controls, and common vulnerability classes.
Experience defining roadmaps, priorities, metrics, and operating processes for security programs with cross-functional dependencies.

Nice To Haves

Experience building or scaling a security engineering function, including team operating models, roadmap planning, prioritization frameworks, metrics, and executive-level reporting.
Experience managing security work in a regulated environment, financial technology company, or organization with high security, privacy, or compliance requirements.
Knowledge of AWS, Kubernetes, containers, CI/CD security, infrastructure-as-code security, identity and access management, vulnerability management, API security, and modern application security testing practices.
Experience implementing or scaling security tooling such as SAST, DAST, SCA, IaC scanning, secrets detection, attack surface management, bug bounty intake, penetration testing workflows, vulnerability management platforms, or developer security guardrails.
Familiarity with security considerations for AI/ML systems, data-intensive applications, lending or financial technology platforms, or other high-trust customer-facing products.
Ability to communicate technical risk, tradeoffs, and recommendations clearly to technical, non-technical, and senior leadership audiences.
Experience partnering with Engineering, Product, Infrastructure, Legal, Risk, Compliance, and Audit teams to deliver security outcomes without creating unnecessary friction.
Security certifications such as CISSP, CSSLP, CCSP, AWS Security Specialty, GIAC, OSCP, or equivalent practical expertise.

Responsibilities

Define and lead the Security Engineering roadmap across application security, infrastructure security, offensive security, and product security, aligning priorities with Upstart’s business objectives, engineering strategy, regulatory expectations, and risk posture.
Manage, coach, and develop a team of security engineers, ensuring clear goals, measurable impact, sustainable execution, effective operating rhythms, and growth opportunities for each team member.
Partner with Engineering, Product, Infrastructure, Data, Risk, Compliance, and Audit leaders to identify high-priority security risks, align on pragmatic mitigations, and embed security requirements early in planning, design, development, and operations.
Scale secure-by-design practices across the SDLC, including threat modeling, security architecture reviews, secure coding practices, automated security testing, vulnerability management, API security, CI/CD protections, secrets management, and developer security enablement.
Strengthen infrastructure and cloud security by partnering with Infrastructure and Platform teams on secure architecture, identity and access controls, Kubernetes and container security, cloud-native security controls, and defense-in-depth across application and infrastructure layers.
Build and mature offensive security capabilities, including attack surface management, adversarial testing, security validation, penetration testing coordination, bug bounty intake, and prioritization of findings into durable engineering improvements.
Improve product security outcomes by partnering with Product and Engineering teams to identify abuse cases, security requirements, customer-impacting risks, and scalable controls for high-trust product experiences.
Drive consistent execution across cross-functional initiatives by setting priorities, clarifying ownership, communicating tradeoffs, and ensuring high-impact security work is delivered with quality and urgency.
Establish and improve Security Engineering metrics, operating models, and reporting so leaders can understand risk posture, remediation progress, recurring patterns, program health, and the effectiveness of security investments.
Support response to high-severity security issues by coordinating technical investigation, stakeholder communication, root cause analysis, remediation tracking, and durable improvements that prevent repeat issues.
Foster a culture where security enables innovation by building trusted partnerships, mentoring engineering leaders, and helping teams adopt practical controls that improve safety without unnecessary friction.

Benefits

Competitive compensation, including base pay, bonus opportunities, and annual equity grants that vest quarterly
Retirement benefits to help you plan for the future, including a 401(k) or Group Retirement Savings Plan with a company match of $2 for every $1 contributed, up to $15,000 annually (USD in the US, CAD in Canada)
Employee Stock Purchase Plan (ESPP) with discounted stock purchase options for eligible employees (US only)
Comprehensive health coverage designed to support you and your family, including medical, dental, vision, and wellness resources for US and supplemental health coverage for Canada.
Health Savings Account contributions from Upstart for eligible plans (US only)
Income protection benefits, including life insurance and disability coverage for added financial security
Paid time off, sick leave, and company holidays, in line with local requirements
Paid family and parental leave to support caregiving and major life moments (duration varies by country)
Family-centered benefits to support fertility, parenthood, and caregiving needs
Employee Assistance Program (EAP) offering mental health support and life-centered resources
Financial wellness resources, including access to financial planning tools and a financial concierge service (US Only)
Annual wellness allowance to support your physical and emotional well-being and personal development, based on what matters most to you
Annual productivity allowance to invest in relevant tools and resources you need to do your best work, no matter where you work from
Connection and community through team events, all-company updates, and employee resource groups (ERGs)
Onsite perks, including catered lunches and fully stocked micro-kitchens when working from one of our offices in the Bay Area, Austin, Columbus, and New York City (opening Summer 2026!)