Staff Security Engineer- Security and Compliance

Veeam Software•San Jose, CA

6d•$289,320 - $537,360

About The Position

Securiti, now part of Veeam, builds the Data Command Center for data security, privacy, governance, and AI security. The Staff Security Engineer provides hands-on technical leadership across product and application security, shaping secure architecture, strengthening the software development lifecycle (SDLC), leading vulnerability response, and helping engineering teams deliver secure cloud and AI capabilities at scale. This is a senior individual-contributor role involving threat modeling, code review, exploit validation, cloud security, software supply chain risk, and discussions with customers and auditors. The role owns and evolves secure development practices across the Securiti portfolio, supports security for AI capabilities, improves security testing and tooling, and leads product vulnerability response. It also strengthens software supply chain security, creates reusable security resources, supports developer enablement, and tracks security metrics. The engineer partners with engineering on technical controls and evidence for compliance and assurance, translates relevant regulations into practical engineering requirements, validates remediation of audit and penetration-test findings, and supports customer due diligence and audit activities. The role collaborates across Engineering, Product, Platform, SRE, and Veeam Corporate Security, influencing security standards and strategy without direct authority.

Requirements

8+ years in security, with substantial experience in application or product security for SaaS or cloud-native platforms.
Strong coding and code-review skills in one or more languages such as Go, Python, Java, or TypeScript, with the ability to validate vulnerabilities and build security tooling.
Deep knowledge of multi-tenant cloud security across AWS, Azure, or GCP, including IAM, Kubernetes, secrets, tenant isolation, and protection of sensitive customer data.
Hands-on experience securing LLM-powered applications, including prompt injection, retrieval leakage, agent authorization, and model supply chain risks.
Demonstrated experience building or materially improving a secure SDLC across multiple engineering teams.
Experience leading vulnerability response or coordinated disclosure, including severity assessment, CVE processes, remediation, and customer communications.
Practical knowledge of software supply chain security, including SBOM, signing, SLSA, and SSDF concepts.
Working experience with security assurance frameworks such as SOC 2, ISO 27001, or FedRAMP.
Strong communication skills and the ability to explain technical risk clearly to engineers, executives, auditors, and customers.
A computer science or engineering degree, or equivalent practical experience.

Nice To Haves

Experience with DSPM, privacy engineering, data governance, CASB, DLP, or other platforms handling highly sensitive customer data.
Experience supporting FedRAMP Moderate or ISO/IEC 42001 for a SaaS platform.
Familiarity with OWASP guidance for LLM applications, NIST AI RMF, and privacy-by-design principles.
Relevant certifications such as CISSP, CSSLP, OSCP/OSWE, CCSP, or GIAC.
Published security research, CVE credits, conference presentations, or open-source security tooling.
Experience collaborating across US and Asian time zones.

Responsibilities

Own and evolve the secure SDLC across the Securiti portfolio, including threat modeling, design reviews, secure code review, and security testing.
Provide security leadership for AI capabilities, including LLM-powered features, agents, copilots, prompt injection, retrieval leakage, permissions, and model supply chain risks.
Tune and improve SAST, dependency, secrets, container, infrastructure, and SBOM controls, integrating actionable findings into engineering workflows.
Lead product vulnerability response from reproduction and severity assessment through remediation, coordinated disclosure, CVE handling, and customer advisories.
Perform targeted penetration testing and security research across applications, APIs, agents, connectors, and cloud services; scope and validate third-party testing.
Strengthen software supply chain security through SBOMs, signed and reproducible builds, dependency governance, and secure release practices.
Build reusable security libraries, reference implementations, hardening guidance, and developer enablement; help scale security through a Security Champions program.
Track and communicate security metrics, including remediation time, critical and high findings, scan coverage, and engineering adoption.
Partner with engineering on technical controls and evidence supporting SOC 2 Type II, ISO 27001/27701, ISO/IEC 42001, HIPAA, PCI, and FedRAMP Moderate readiness.
Translate applicable requirements such as GDPR, CCPA, the EU AI Act, DORA, and NIS2 into practical engineering requirements and release criteria.
Validate remediation of audit and penetration-test findings and escalate material risks when needed.
Serve as a technical security partner for customer due diligence, audits, security questionnaires, AI-risk reviews, and executive briefings.
Work across Engineering, Product, Platform, SRE, and Veeam Corporate Security to incorporate security risk into architecture and roadmap decisions.
Influence engineering standards and security strategy without relying on direct authority.
Represent Securiti in technical discussions with customers, auditors, standards bodies, and the security research community.

Benefits

Unlimited paid time off.
12 paid holidays, including 4 global VeeaMe Days for self-care.
24 paid volunteer hours annually through Veeam Cares.
Paid parental leave: 8 weeks for all parents and 16 weeks for birthing parents.
Medical, dental, and vision coverage starting on the first day.
Mental health support, therapy sessions, and digital wellness tools via the Employee Assistance Program.
401(k) retirement plan with company matching contributions.
Fertility, adoption, and surrogacy support through Maven.
AirVet 24/7 virtual veterinary care at no cost.
Legal services, identity protection, and supplemental health insurance options.
Tax-advantaged spending accounts for healthcare, dependent care, and commuting.
Learning and growth opportunities, including on-demand libraries, mentoring, workshops, and learning events.