Senior / Staff Security Engineer

Linear

4d•Remote

About The Position

Linear is hiring a senior-level, hands-on Security Engineer to strengthen security across its product and infrastructure as the company evolves its product and grows its enterprise presence. The role has significant autonomy and scope, with work spanning vulnerability management, bug bounty operations, product security testing, incident response, cloud and infrastructure security, security automation, and collaboration with the GRC/Trust function. The engineer will help keep vulnerabilities from becoming incidents, respond effectively when incidents occur, and turn findings into concrete improvements. The role involves working with Linear’s product and infrastructure teams, including on AI- and agent-facing product surfaces. It is a technical, builder-oriented position involving code review and testing, security tooling and automation, cloud configuration hardening, and using AI/LLM tools to make security work more efficient. Linear is remote-first, and this role is open to candidates located anywhere in North America. The company emphasizes deep focus, asynchronous collaboration, and occasional in-person connection through off-sites, optional co-working, and travel.

Requirements

At least 5 years of experience across security engineering.
Significant depth in at least two of the following: vulnerability management, product/application security testing, incident response, and cloud security; breadth across these areas is important.
Hands-on technical ability, including being able to read and reason about code; Linear uses a lot of TypeScript.
Comfort working in cloud environments; GCP experience is a plus.
Ability to investigate security findings in depth and work beyond simply filing tickets for others.
Comfort using AI coding and security tools as force multipliers.
Ability to lead security incidents from the first alert through postmortem without needing direction on each next step.
A builder mindset, including willingness to write scripts or ship tools to replace repetitive manual work.
Pragmatic risk-reduction approach focused on reducing actual risk rather than checking boxes or maximizing finding counts.
Ability to set priorities and work independently, while recognizing when to escalate.
Clear communication skills, including explaining technical findings to non-technical stakeholders and writing actionable reports.

Nice To Haves

GCP experience.

Responsibilities

Operate, automate, and extend vulnerability management end to end, including triaging and prioritizing findings, driving remediation across product, infrastructure, and dependencies, and maintaining meaningful program SLAs.
Run the bug bounty program by triaging reports, validating severity, coordinating fixes with engineering, and maintaining professional, responsive researcher relationships.
Lead product security testing by threat modeling new features, including AI- and agent-facing surfaces, reviewing designs and code, and conducting manual and tool-assisted testing.
Serve as a primary responder for security incidents, leading investigation and containment, driving postmortems, and translating lessons into concrete hardening work.
Own significant areas of cloud and infrastructure security across GCP, Kubernetes, and Postgres, including hardening configurations, closing gaps identified by audits or scanning, and partnering with infrastructure engineering on secure defaults.
Build and maintain security tools and automation, including using AI/LLM tools to accelerate triage, code review, and repetitive investigations.
Partner with the GRC/Trust function by contributing findings to the risk register and control evidence and helping ensure compliance requirements reflect engineering practice.

Benefits

Competitive salary and equity.
Employee-friendly equity terms, including early exercise in the US and extended exercise windows.
Daily meal and coffee stipend on every workday.
Paid co-working space or desk.
Health coverage based on country requirements.
Five weeks of paid vacation, plus local statutory holidays.
Four months of paid parental leave.
A paid month off after four years and every two years thereafter.
Regular team events and off-sites.
Remote-first work with no required commute.