Sr. Security Engineer

C1•San Francisco, CA

9d•Hybrid

About The Position

C1 is seeking a Senior Security Engineer to join its early-stage security team. This generalist role involves security engineering, application and cloud security, and compliance. The primary focus is on building automated agents and skills to integrate security into the development lifecycle using a risk-based approach, aiming to embed security from the design phase rather than relying on post-deploy reviews. The engineer will collaborate with development teams to implement fixes and solve problems systemically, making it easier for everyone to build securely by default. The company's stack is primarily Go and AWS.

Requirements

Proven experience securing enterprise SaaS applications, including authentication flows, authorization patterns, and input validation at API boundaries.
Demonstrated experience securing deployment and change-management mechanisms for software and infrastructure.
Background in Software Engineering, Platform Engineering, Systems Engineering, Network Engineering, Cloud Security, or Application Security.
Hands-on code review experience, ideally in Go, Python, or Rust.
Experience with AWS (or another major cloud provider) and comfort working across cloud infrastructure.
Comfortable working both independently and collaboratively in a fast-paced, high-growth environment.
Curious and current on modern security practices, tooling, and emerging threats, including how AI is changing the threat landscape.
Ability to participate quarterly in-person in one of our primary offices (San Francisco, or Portland Oregon).
Real, hands-on experience building agents and automation for security.
Readiness to share a project, demo, or repo where you built an agent, skill, or automation that replaced manual security work, or examples of how you use AI coding tools or agentic workflows, or a walkthrough of a security automation you shipped.

Nice To Haves

Experience with Kubernetes, service mesh, or PKI/network technologies (Consul, Envoy, Cilium, Vault, Istio, etc.).
Experience building or extending internal security tooling, automations, or agents.
Prior experience at a high-growth SaaS or identity/access management company.

Responsibilities

Define and drive security standards and secure-by-default solutions, serving as a subject matter expert for application and/or cloud security.
Build purpose-built agents and skills that orchestrate security into the development lifecycle through a risk-based approach, automating manual, repetitive work.
Shift security left by baking risk-based review into design specs and architecture decisions.
Build security tooling and automation that scales security practices across engineering.
Help implement meaningful, actionable security observability and detection signals.
Lead threat modeling and risk assessment for high-risk features and platform changes.
Assess and help mitigate security risks introduced by agentic development practices and AI-powered product features.
Partner with engineering teams to prioritize and remediate critical threats, define API security standards, and conduct security code reviews.
Continuously explore and adopt open-source tools to assess the security of and test services.
Identify systemic security risks and lead multi-team remediation efforts end-to-end.
Partner across security, compliance, and engineering on cross-domain problems.
Contribute to compliance and trust initiatives (e.g., SOC 2, ISO 27001/42001).
Invest in the growth of teammates and in raising the security bar across the broader engineering org.