Staff Security Engineer

Root Insurance

3d•$157,000 - $196,000•Remote

About The Position

At Root, the Staff Security Engineer will drive security strategy across the enterprise and serve as a technical force multiplier for the Information Security and IT organizations. The role connects business risk with operational execution, establishes secure standards and practices, supports secure AI adoption, and advances technical maturity in response to the insurance business and regulatory landscape. This hands-on role defines security architecture for cloud environments and applications, integrates security throughout product development, and builds measurable security programs. It also owns security tooling decisions, provides technical guidance to engineers, and participates in the security engineering team's on-call rotation. Root supports employees working from any location across the United States that works best for them.

Requirements

10+ years of security experience spanning security operations, product security, infrastructure security, and application security.
Experience setting architectural direction through roadmaps, standards, and secure reference patterns adopted by more than one business unit.
Experience partnering with product and engineering leaders to integrate threat modeling, design reviews, and secure defaults into the development lifecycle.
Deep technical breadth in AWS cloud and traditional enterprise security, with hands-on proof-of-concept development and system troubleshooting experience.
Experience running security metrics programs that inform prioritization and demonstrate impact.
Experience designing systems to align with best practices and regulatory requirements, and preparing systems to pass audits by design.
Hands-on experience securing AI systems, including threat modeling and runtime defense, and using AI to automate security work.
Ability to communicate with non-security stakeholders in plain language, build consensus, and influence engineering leadership.
Bachelor's or Master's degree in Computer Science, Cybersecurity, or a related technical field, or equivalent practical experience.
Willingness to participate in the security engineering team's on-call rotation.

Nice To Haves

CISSP certification.
Offensive security experience such as penetration testing, red teaming, or exploit development; experience attacking AI systems is an additional plus.

Responsibilities

Define architectural standards to protect employees, customers, and core systems across cloud environments and applications.
Integrate security into the development lifecycle by threat-modeling product features, reviewing designs, and building secure libraries and CI checks.
Build security metrics and scorecards that demonstrate risk reduction and connect security spending to relevant risks and compliance obligations.
Secure AI systems through architecture, threat modeling, and runtime protections; use AI to automate vulnerability management, threat detection, and security operations.
Advise and mentor engineers through design reviews and pairing, explaining the rationale behind security practices.
Own the security tooling stack and make build-versus-buy decisions to ensure controls scale and meet requirements.
Participate in the security engineering team's on-call rotation.