Senior/Staff Security Engineer

Sandbar•New York City, NY

21h

About The Position

Sandbar is an interface company based in New York City, building technology intended to extend human thinking. Its first product, Stream, is a private voice ring and conversational interface that begins shipping in Summer ’26. Sandbar is seeking a senior or staff backend engineer with deep security expertise to build Stream’s backend systems and make user privacy real. The role owns how data is encrypted, keys are managed, services and people authenticate to infrastructure, and security problems are detected and addressed. The engineer will define security within a small backend team, working directly on a live production service rather than in a separate security function. The position combines security engineering with core backend development. It includes building encryption and confidential-computing systems, securing identity, secrets, software supply chains, and CI/CD, and developing operational detection and response practices. The engineer will also guide vendor and data-handling security, lead engineering-side compliance work, contribute features to real-time Python services, and establish secure engineering practices through design reviews and threat models.

Requirements

At least 7 years building and operating backend systems, including meaningful time as the engineer accountable for security on a production service.
Strong Python skills and comfort owning a live, real-time service end to end.
Hands-on applied cryptography experience, including envelope encryption, authenticated encryption, key hierarchies, and awareness of practical design mistakes.
Deep cloud security experience on AWS and/or GCP, including IAM, workload identity federation, KMS, secrets management, and audit logging.
Experience leading production-service incident response from containment through follow-up hardening.
Comfort with document stores and their access-control models.
Ability to make tradeoffs explicitly and ship, distinguishing controls that must gate a launch from those that can follow.
Ability to communicate precisely with engineers, founders, auditors, and vendors.

Nice To Haves

Experience with confidential computing or attestation, such as Nitro Enclaves, SEV-SNP, TDX, or App Attest.
iOS security primitives experience, including Secure Enclave or Keychain.
Bluetooth LE device security, firmware signing, or secure pairing experience.
Experience with retrieval systems or LLM infrastructure and their data-flow controls.
SOC 2 or ISO 27001 audit experience from the engineering side.

Responsibilities

Design and ship end-to-end encryption for user data, including key management and support for search and background processing on encrypted data.
Build confidential-computing infrastructure that isolates and verifies sensitive processing, including attestation and reproducible builds.
Own identity and secrets across the stack, including short-lived workload credentials, least-privilege service identities, environment isolation, and auditable privileged access.
Own supply-chain and CI/CD security.
Build the detection and response loop, including audit logging, alerting, runbooks, and post-incident reviews that lead to engineering changes.
Drive vendor and data-handling security, including AI provider data agreements, third-party integration and OAuth scope reviews, and data retention and deletion.
Lead compliance work such as SOC 2 from the engineering side, with controls enforced by systems and evidence produced automatically.
Contribute to core backend work by building product features on the real-time Python services and reviewing the team’s changes with a security focus.
Set direction for secure engineering practices through design reviews, threat models, and clear, minimal guidance.