Staff Security Engineer - Enterprise & Third Party Risk Management

LinkedIn•Mountain View, CA

1d•Hybrid

About The Position

LinkedIn's Enterprise & Third-Party Security team is dedicated to protecting our data, systems, and global members by managing security and privacy risks throughout our external ecosystem. We collaborate across the organization to evaluate the security maturity of our partners and suppliers, identifying systemic threats and providing the technical guidance necessary for the secure integration of external services. Our mission is to leverage security engineering, advanced risk analytics, and automation to provide continuous assurance and visibility throughout the third-party lifecycle. We are committed to building scalable, high-impact solutions that mitigate vulnerabilities and ensure all external engagements align with LinkedIn’s rigorous security, privacy, and regulatory standards. As a Staff Security Engineer focused on Third-Party Technology Security (TPS), you will strengthen LinkedIn's security posture by identifying and mitigating security risks introduced by third-party technologies, services, platforms, and integrations. You will be a foundational technical leader driving enterprise security initiatives responsible for evolving the TPS program beyond traditional security governance, risk and compliance programs to an engineering driven program that designs, automates, and scales the controls, workflows and tooling that protect LinkedIn and our customers. The ideal candidate is equally comfortable shaping policy and shipping modern tooling using Python, Claude, and other agentic coding platforms to replace manual GRC work with scalable, code defined workflows. They will partner with enterprise innovation, GRC, procurement, legal, and technical security teams to ensure that third party vendors including complex SaaS/AI tools meet our security standards. You serve as the subject matter expert in transforming security risk management from a compliance oriented function into a security engineering discipline.

Requirements

BA/BS degree in Computer Science, Cybersecurity, Information Security, or related technical field, or equivalent technical experience
5+ years of experience leading technical security reviews and risk assessments for third-party technologies, SaaS platforms, cloud services, APIs, enterprise applications, or vendor integrations.
5+ years of experience in security engineering with in-depth knowledge in one or more areas such as application security, cloud security, security architecture, identity and access management, infrastructure security, or software supply-chain security
5+ years of experience with technical security assessment methodologies such as threat modeling, security architecture or security design reviews
Experience with programming languages such as Java, GO, or Python and building automation or tooling to improve security engineering workflows
Experience with industry based information security and controls frameworks like NIST, PCI DSS, SOC 2, and ISO 27001

Nice To Haves

BS and 8+ years of relevant work experience, MS and 7+ years of relevant work experience, or PhD and 4+ years of relevant work experience
Experience building or scaling a Third-Party Security, Vendor Security, or Supply Chain Security programs within a large scale technology company
Experience integrating security workflows across GRC platforms, ticketing systems, identity providers, cloud platforms, asset inventories, and vendor management systems.
Experience designing automation that replaces manual security governance, risk management, or compliance processes, including intake, evidence collection, risk assessment, control validation, reporting, and workflow orchestration
Experience building, deploying and reviewing automation for complex security workflows, including use of both AI driven and traditional automation tools
Experience building automation or security tooling that improves assessment coverage, control validation, attack-surface identification, or continuous security monitoring
Demonstrated ability to identify systemic security risks and translate individual security findings into platform-level controls and architectural improvements
Ability to partner with global stakeholders to align technical strategies and security initiatives with broader organizational objectives
Demonstrated ability to influence architecture and engineering decisions across multiple organizations without direct authority
Ability to understand the communicate technical issues to non technical teams
Demonstrated ability to drive projects towards completion
Hands on experience with agentic coding tools
Excellent verbal and written skills

Responsibilities

Establish a foundational framework for third party security (TPS) assessment to automate and integrate security requirements seamlessly into the broader enterprise security ecosystem
Lead and mature the TPS including the design, implementation, and continuous improvement of processes, controls, and operational workflows
Architect AI drive automation to accelerate vendor on boarding velocity and implement a centralized data engine that provides executive level visibility and granular risk metrics across LI
Build and maintain automation that replaces manual GRC tasks like intake, triage, evidence collection, control validation, tracking, escalation, and reporting using either Python or agentic coding tools
Design and operate workflow orchestration and integrations across systems like ticketing, GRC platforms, vendor management tools, identity provides and cloud control planes
Translate ambiguous business requirements into practical, scalable security solutions and decision frameworks
Identify opportunities to automate manual processes across the program and prototype solutions yourself rather than waiting on an engineering backlog
Drive program operational excellence by establishing repeatable processes, service level expectations, metrics, and reporting for third party security risk management
Manage complex escalations, act as technical lead for escalations, evaluating edge case architectures and designing technical roadmaps for high risk vendors to ensure they meet LinkedIn’s security standards
Act as lead incident commander within LinkedIn in the event of data security breach of third party and drive successful resolution
Partner with other teams in InfoSec to conduct holistic reviews and engineer “paved path” blueprints for common high risk third party scenarios
Conduct threat modeling on high risk integrations and partner with Security SMEs for deeper diligence
Act as trusted advisor and SME on third party security risk management, helping stakeholders make informed risk based decisions
Provide foundational technical leadership and mentorship to security engineers, driving strategic direction and high impact risk reduction initiatives across the org