Sr. Corporate Security Engineer

Material Security•San Francisco, CA

13d•$220,000 - $240,000•Remote

About The Position

Material Security is seeking a Senior Corporate Security Engineer to strengthen its internal corporate security environment and adapt its mature security program to LLM-based security tooling. The role focuses on hardening corporate services, improving detection efficacy and response times, protecting customer data, and serving as a customer zero for Material Security’s product. The engineer will work with Engineering to turn internal findings into detection improvements for customers. The environment includes a Mac-only fleet, Google Workspace, security services such as a SIEM, identity provider, EDR, fleet management, and a cloud production environment. The role owns corporate detection and response and LLM-driven triage, while collaborating with the CorpSec team on endpoint, identity, SaaS, and Google Workspace security, and with AppSec on the corporate-to-production boundary. Material Security is a remote-first workplace with an office in San Francisco, California.

Requirements

At least 6 years of experience in corporate or enterprise security or detection and response, with hands-on ownership of a SIEM, detection content, and incident response.
Comfort with Python, Go, or TypeScript and working directly with vendor APIs; ability to automate enforcement rather than configure it manually.
Deep understanding of OAuth, SAML/OIDC, session and token lifecycle, and how identity reaches cloud IAM.
Experience managing a Mac fleet with modern MDM and EDR and moving controls from deployed to enforced.
Experience building or seriously experimenting with LLM-driven workflows, including prompting, tool use, and evaluation, and ability to explain how to assess their effectiveness.
Experience owning a corporate stack end to end across devices, identity, SaaS, and collaboration.
Experience writing detections that have caught real attacks, reducing noise, and measuring the results.
Experience responding to live incidents and making containment decisions.
Ability to work collaboratively, curiously, and directly, including alongside more junior engineers.

Nice To Haves

Contributed detection logic or security features to a product codebase and is comfortable working within an engineering team’s review and release process.
Has written a technical paper, spoken at a technical conference, or maintained open-source security tooling.

Responsibilities

Own corporate telemetry and detection content, close coverage gaps, reduce alert noise with measured fidelity, and develop detections for account takeover, session token theft, malicious OAuth grants, administrator abuse, and exfiltration by authorized users.
Lead corporate incident response and own incident-response playbooks.
Design and build an LLM-based agent to review privileged-access grants, customer-data access, and high-fidelity endpoint and identity alerts in near real time.
Create labeled evaluation sets and measure precision and recall for LLM-driven triage; define limits on automated actions and defend against manipulation through log content or employee replies.
Collaborate with the CorpSec team on Mac fleet device management and endpoint detection, including automating update enforcement, deepening EDR coverage, implementing browser-level DLP, and enforcing BYOD posture on iOS and Android.
Collaborate with the CorpSec team on the identity provider and SaaS estate, maintaining phishing-resistant authentication, addressing applications that cannot use SSO, automating access-review evidence, and converting vendor and OAuth application reviews into a pipeline.
Collaborate with the CorpSec team on Google Workspace admin alerting, OAuth governance, Apps Script governance, sharing, and DLP, using Material Security’s product where appropriate.
Partner with Engineering to propose, test, and ship product detection updates based on findings in the company’s own Google Workspace tenant.
Collaborate with AppSec on the corporate-to-production boundary, including cross-boundary detections, just-in-time access, and logging of who accessed what.
Work collaboratively and directly, support junior engineers without taking over, and seek to automate repetitive work.