Staff Security Engineer @ Sandbar

Blaze Talent•New York, NY

About The Position

Sandbar is an interface company based in New York City. Its first product, Stream, is a private voice ring and conversational interface designed to help people expand their thinking. Sandbar is seeking a senior or staff backend engineer with deep security expertise to build and secure Stream’s backend systems. The role focuses on making user privacy real through data encryption, key management, authentication, and security detection and response. The engineer will define security practices at Sandbar while working within a small backend team on a live production service, rather than within a separate security function. The position also contributes to core backend product development and sets direction for secure engineering practices.

Requirements

At least 7 years of experience building and operating backend systems, including meaningful time as the engineer accountable for security on a production service.
Strong Python skills and comfort owning a live, real-time service end to end.
Hands-on applied cryptography experience, including envelope encryption, authenticated encryption, key hierarchies, and awareness of practical design pitfalls.
Deep cloud security experience on AWS and/or GCP, including IAM, workload identity federation, KMS, secrets management, and audit logging.
Experience leading incident response on a production service, from containment through follow-up hardening.
Comfort with document stores and their access-control models.
Ability to make tradeoffs explicitly and ship, distinguishing controls that must gate a launch from those that can follow.
Ability to communicate precisely with engineers, founders, auditors, and vendors.

Nice To Haves

Experience with confidential computing or attestation, such as Nitro Enclaves, SEV-SNP, TDX, or App Attest.
iOS security primitives, including Secure Enclave and Keychain.
Bluetooth LE device security, firmware signing, or secure pairing.
Experience with retrieval systems or LLM infrastructure and their data-flow controls.
SOC 2 or ISO 27001 audit experience from the engineering side.

Responsibilities

Design and ship end-to-end encryption for user data, including key management and support for search and background processing on encrypted data.
Build confidential-computing infrastructure that isolates and verifies sensitive processing, including attestation and reproducible builds.
Own identity and secrets across the stack, including short-lived workload credentials, least-privilege service identities, environment isolation, and auditable privileged access.
Own supply-chain and CI/CD security.
Build the detection and response loop, including audit logging, alerting, runbooks, and post-incident reviews that result in engineering changes.
Drive vendor and data-handling security, including AI provider data agreements, third-party integration and OAuth scope reviews, and data retention and deletion.
Lead compliance work such as SOC 2 from the engineering side, with system-enforced controls and automatically produced evidence.
Contribute to core backend work by building product features on the real-time Python services and reviewing team changes with a security focus.
Set direction for secure engineering practices through design reviews, threat models, and clear, minimal guidance.