FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates extensive experience in defining and executing security strategies, managing security incidents, and integrating security into development processes. Proficient in application and API security within multi-tenant SaaS environments, with a strong focus on compliance and vulnerability management.
Highest-signal resume keywords
Senior Security ExperienceApplication And API SecurityAWS And KubernetesSOC 2 ComplianceTypeScript Code Modification
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Threat ModelingVulnerability ManagementSecurity Incident ResponseAuthorization ModelsOAuthOIDCSession FlowsIDORSSRFSecurity Bug Fixing
Soft Skills
Strong Written CommunicationFollow-ThroughAbility To Thrive In Remote Environments
Tools & Technologies
AWSKubernetesCloudflareTypeScriptPHPPythonAI Tools
Industry Keywords
SOC 2Vulnerability Disclosure ProgramMulti-Tenant SaaSPublic APISecurity Standards
Tech Stack
Tools & technologiesAWSKubernetesPHPPythonTypeScript
About the role
Key responsibilities & impact- Define Buffer’s security strategy and roadmap, set priorities, drive execution, and establish security standards
- Identify security problems, define solutions, and build tooling, automation, and processes
- Integrate security into development through PR checks, threat modeling, dependency, secrets, and supply-chain hygiene
- Advance operational security while preserving Buffer’s high-trust environment
- Manage the security inbox, requests from other teams, maintenance, and chores
- Lead security incidents and participate in the engineering-wide on-call rotation
- Run incident-response tabletops and ensure identified gaps are fixed
- Threat-model AI agents, connectors, and in-product AI; establish security guardrails
- Triage vulnerability-disclosure reports and manage the vulnerability disclosure program
- Own SOC 2, Meta platform compliance, customer security questionnaires, and customer trust initiatives
- Collaborate with product engineering teams on technical-spec reviews and grow security champions
- Support Advocacy and People teams with security and compliance needs
- Report to Miguel, Engineering Manager for Infrastructure and Security
Requirements
What you’ll need- Must be based between UTC-3 and UTC+3
- Senior security experience without a CISO above you
- Hands-on application and API security experience in a multi-tenant SaaS, ideally with a public API
- Experience with authorization models, OAuth, OIDC, session and authentication flows, IDOR, SSRF, and threat modeling
- Experience finding and fixing security bugs
- Ability to write and modify TypeScript code and review code; familiarity with legacy PHP and Python
- Experience leading security incidents end-to-end, including status updates, customer communications, and postmortems
- Experience with AWS, Kubernetes, and Cloudflare, or similar technologies
- Experience running or closely supporting a SOC 2 or similar program
- Experience automating evidence collection
- Experience running or triaging a vulnerability disclosure or bug bounty program
- Fluency with modern AI tools and experience securing systems that use them
- Ability to thrive in remote, asynchronous environments
- Strong written communication and follow-through
- Familiarity with Buffer or social media management tools is a bonus
- Experience working fully remotely as part of a distributed team for one year or more
- Experience merging code into a production codebase reviewed by other engineers within the last 12 months
Benefits
Comp & perks- Equity
- Two paid days working with the team during the collaboration period
- Fully distributed and remote work environment
- Travel to work together in person once or twice per year
- Transparent, fair, simple, and generous compensation approach