Staff Security Engineer Jobs
Staff Security Engineer jobs are open across fintech, healthtech, enterprise software, and government contracting, from senior engineer to principal and staff levels, with specializations in cloud security, application security, and security architecture. See the openings below and apply to the ones that match your experience.
Find Staff Security Engineer JobsOverview
Showing 5 of 315+ Staff Security Engineer jobs
Staff AI Engineer, Security
Location: Austin, TX, United States
Category: Technology
Job ID: 3148
Apply Now
Description
Recognized as the No. 1 site trusted by real estate professionals, Realtor.com® has been at the forefront of online real estate for over 25 years, connecting buyers, sellers, and renters with trusted insights and expert guidance to find their perfect home. Through its robust suite of tools, Realtor.com® not only makes a significant impact on the real estate industry at large, but for consumers, navigating the biggest purchase they will make in their life, by providing a user experience that is easy to use, easy to understand, and most of all, easy to make decisions.
Join us on our mission to empower more people to find their way home by breaking barriers to entry, making the right connections, and building confidence through expert guidance.
Realtor.com is growing how it uses AI, from internal tools and coding assistants to fleets of autonomous agents. We need a security engineer whose core skill is cybersecurity and whose focus is AI. Recent incidents, like an AI model under test breaking into another company's infrastructure, show the new kinds of risk: agents acting outside their intended scope, models and tools pulled from public hubs, and normal automation becoming an attack path. You'll make sure our systems are built to contain all of that, and that the secure option is also the easy one. You'll work closely with News Corp's global cybersecurity team, bringing AI security depth to Realtor.com while aligning with group-wide standards.
We are looking for a rigorous practitioner who advocates for software engineering excellence across the full Product Development Life Cycle (PDLC). You will leverage AI through spec-driven design, automation-driven provisioning, and robust platform maintenance, eliminating ad hoc ownership and freeing solution builders to focus on workflow design and delivery.
What You'll Do:
Secure the AI platform (AWS and GCP)
Design and enforce guardrails for AI workloads on AWS (Bedrock, Lambda, IAM, KMS, SCPs, GuardDuty, Security Hub) and GCP (Vertex AI, IAM, VPC Service Controls, Org Policies, Security Command Center, Cloud KMS).
Define how agents and other non-human accounts are identified and authorized: short-lived, narrowly scoped credentials, delegated user permissions, and a per-agent audit trail, so a misbehaving agent can only do limited damage.
Build containment for agents: separate read and write permissions, network egress controls, sandboxed execution, approval gates for high-risk actions, and kill switches.
Design an agent gateway or control plane that keeps agents and their tool calls within approved limits.
Secure the AI supply chain: where models come from and how they're scanned (including unsafe formats like pickle), vetting of models and datasets from public hubs such as Hugging Face, an approval process for new MCP servers and agent tools, and an inventory of the models, data, and tools each system uses (an AI-BOM).
Defend against prompt injection, tool poisoning, poisoned retrieval data (RAG poisoning), and sensitive data leakage.
Put detection and logging in place for agent and model activity, and own the incident response playbooks for AI-specific events.
Review and guide what gets built
Lead threat modeling for new products, features, and internal solutions, from consumer-facing experiences to internal tools and agent workflows. Use frameworks like STRIDE, the OWASP LLM/GenAI Top 10, MITRE ATLAS, and OWASP ASVS. Turn the findings into clear design requirements and release criteria.
Review pull requests, architecture designs, and release-readiness for everything from apps to agent fleets, and make concrete suggestions that move work forward instead of blocking it.
Build paved-road frameworks, reference architectures, and secure-by-default templates that rule out whole categories of risk, instead of catching them one PR at a time.
Build security into CI/CD: secrets scanning, SAST/SCA, GitHub Actions hardening, and policy-as-code in Terraform.
Build an ongoing red-team and evaluation program for our models, agents, and LLM apps, and test new AI features before launch.
Partner with News Corp cybersecurity
Work with News Corp's global cybersecurity team to align Realtor.com's AI and cloud security with group-wide standards, policies, and risk frameworks.
Coordinate on incident response, threat intelligence, and vulnerability disclosure across News Corp businesses.
Share AI security patterns, threat models, and lessons learned with other News Corp businesses, and bring their insights back to Realtor.com.
Use AI to do security work
Build agents that help do the security work: triage findings, investigate alerts, audit IAM for least privilege, and open tested, secure-by-default fix PRs.
Use Claude Code, Devin, and MCP to make the security team faster, and share those patterns with other engineering teams.
Stay ahead of the field
Track new AI threats, incidents, research, and vendor capabilities as they emerge, and turn them into concrete actions for our platform. That includes new attack techniques, model and agent releases, and changes to OWASP, MITRE ATLAS, and other frameworks.
When a major industry incident happens, quickly assess whether we're exposed and lead the response.
Prototype new approaches when existing tools and best practices don't fit yet. Run small experiments, measure the results, and turn what works into platform standards.
Share what you learn: write short internal briefings on major developments and recommend when to adopt, pilot, or skip a new tool or practice.
Educate and lead
Create and run AI security training for engineers, product teams, and the wider company: prompt injection, data leakage, excessive agency, and secure use of tools like Claude, Glean, Devin, and Gemini.
Act as the security voice in AI platform strategy: evaluate vendors and models, set the bar for what's production-ready, and help shape AI governance across the whole AI lifecycle.
Brief leadership on AI risk and where to invest.
Represent Realtor.com externally through conference talks, open-source work, or industry working groups.
What You'll Bring:
8+ years in cybersecurity, cloud security, AppSec/product security, or security platform engineering. Bachelor's degree or equivalent experience.
Hands-on depth in AWS security, plus real experience in GCP (or a strong multi-cloud background).
You know that telling an AI not to do something isn't security. You think in permissions, scopes, logs, approval gates, data boundaries, and rollback.
Experience securing LLM or agentic systems, including prompt injection defenses, retrieval and data-boundary risks, agent identity, and model or tool supply-chain integrity.
Experience doing threat modeling for products and platforms, not just infrastructure. You can lead a session with engineers and product managers and turn it into requirements they'll actually follow.
Hands-on experience building with agents, tool calling, or MCP, and with AI coding tools.
Strong code-review skills in at least one of Python, TypeScript, or Go, and comfort with Terraform/IaC.
Experience with zero trust, least privilege, SSO/OIDC/OAuth, secrets management, and vulnerability management.
Experience working within a larger security organization, such as a parent company, central security team, or federated model. You can balance local speed with alignment to enterprise standards.
Follow AI security research, incident write-ups, and the security community, and you can point to something recent you learned and acted on.
A builder's mindset. You'd rather prototype a new control than wait for a vendor to ship one, and you're comfortable working where the playbook doesn't exist yet.
Explain risk clearly to any audience, from a PR comment to an executive briefing to a training session for the whole company.
Nice to have:
AWS Security Specialty, Google Professional Cloud Security Engineer, CCSP, CISSP, OSCP, or GIAC (GCSA/GWEB).
Experience red-teaming or evaluating AI models or agents.
Familiarity with NIST AI RMF, ISO 42001, Google SAIF, CoSAI, NIST SSDF, or the EU AI Act.
Experience securing Snowflake (RBAC, masking, network policy).
Conference talks, published research, or open-source security contributions.
How We Work:
We balance creativity and innovation on a foundation of in-person collaboration. For most roles, our employees work four or more days in our offices, where they have the opportunity to collaborate in-person, adding richness to our culture and knitting us closer together.
How We Reward You:
Realtor.com is committed to investing in the health and wellbeing of our employees and their families. Our benefits programs include, but are not limited to:
Inclusive and Competitive medical, Rx, dental, and vision coverage
Family forming benefits
13 Paid Holidays
Flexible Time Off
8 hours of paid Volunteer Time off
Immediate eligibility into Company 401(k) plan with 3.5% company match
Tuition Reimbursement program for degreed and non-degreed programs
1:1 personalized Financial Planning Sessions
Student Debt Retirement Savings Match program
Free snacks and refreshments in each office location
Do the best work of your life at Realtor.com®
Here, you’ll partner with a diverse team of experts as you use leading-edge tech to empower everyone to meet a crucial goal: finding their way home. And you’ll find your way home too. At Realtor.com®, you’ll bring your full self to work as you innovate with speed, serve our consumers, and champion your teammates. In return, we’ll provide you with a warm, welcoming, and inclusive culture; intellectual challenges; and the development opportunities you need to grow.
Diversity is important to us, therefore, Realtor.com® is an Equal Opportunity Employer regardless of age, color, national origin, race, religion, creed, gender, sex, sexual orientation, gender identity and/or expression, marital status, status as a disabled veteran and/or veteran of the Vietnam Era or any other characteristic protected by federal, state or local law. In addition, Realtor.com® will provide reasonable accommodations for otherwise qualified disabled individuals.
We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
Apply Now
Staff AI Engineer, Security
Location: Austin, TX, United States
Category: Technology
Job ID: 3148
Apply Now
Description
Recognized as the No. 1 site trusted by real estate professionals, Realtor.com® has been at the forefront of online real estate for over 25 years, connecting buyers, sellers, and renters with trusted insights and expert guidance to find their perfect home. Through its robust suite of tools, Realtor.com® not only makes a significant impact on the real estate industry at large, but for consumers, navigating the biggest purchase they will make in their life, by providing a user experience that is easy to use, easy to understand, and most of all, easy to make decisions.
Join us on our mission to empower more people to find their way home by breaking barriers to entry, making the right connections, and building confidence through expert guidance.
Realtor.com is growing how it uses AI, from internal tools and coding assistants to fleets of autonomous agents. We need a security engineer whose core skill is cybersecurity and whose focus is AI. Recent incidents, like an AI model under test breaking into another company's infrastructure, show the new kinds of risk: agents acting outside their intended scope, models and tools pulled from public hubs, and normal automation becoming an attack path. You'll make sure our systems are built to contain all of that, and that the secure option is also the easy one. You'll work closely with News Corp's global cybersecurity team, bringing AI security depth to Realtor.com while aligning with group-wide standards.
We are looking for a rigorous practitioner who advocates for software engineering excellence across the full Product Development Life Cycle (PDLC). You will leverage AI through spec-driven design, automation-driven provisioning, and robust platform maintenance, eliminating ad hoc ownership and freeing solution builders to focus on workflow design and delivery.
What You'll Do:
Secure the AI platform (AWS and GCP)
Design and enforce guardrails for AI workloads on AWS (Bedrock, Lambda, IAM, KMS, SCPs, GuardDuty, Security Hub) and GCP (Vertex AI, IAM, VPC Service Controls, Org Policies, Security Command Center, Cloud KMS).
Define how agents and other non-human accounts are identified and authorized: short-lived, narrowly scoped credentials, delegated user permissions, and a per-agent audit trail, so a misbehaving agent can only do limited damage.
Build containment for agents: separate read and write permissions, network egress controls, sandboxed execution, approval gates for high-risk actions, and kill switches.
Design an agent gateway or control plane that keeps agents and their tool calls within approved limits.
Secure the AI supply chain: where models come from and how they're scanned (including unsafe formats like pickle), vetting of models and datasets from public hubs such as Hugging Face, an approval process for new MCP servers and agent tools, and an inventory of the models, data, and tools each system uses (an AI-BOM).
Defend against prompt injection, tool poisoning, poisoned retrieval data (RAG poisoning), and sensitive data leakage.
Put detection and logging in place for agent and model activity, and own the incident response playbooks for AI-specific events.
Review and guide what gets built
Lead threat modeling for new products, features, and internal solutions, from consumer-facing experiences to internal tools and agent workflows. Use frameworks like STRIDE, the OWASP LLM/GenAI Top 10, MITRE ATLAS, and OWASP ASVS. Turn the findings into clear design requirements and release criteria.
Review pull requests, architecture designs, and release-readiness for everything from apps to agent fleets, and make concrete suggestions that move work forward instead of blocking it.
Build paved-road frameworks, reference architectures, and secure-by-default templates that rule out whole categories of risk, instead of catching them one PR at a time.
Build security into CI/CD: secrets scanning, SAST/SCA, GitHub Actions hardening, and policy-as-code in Terraform.
Build an ongoing red-team and evaluation program for our models, agents, and LLM apps, and test new AI features before launch.
Partner with News Corp cybersecurity
Work with News Corp's global cybersecurity team to align Realtor.com's AI and cloud security with group-wide standards, policies, and risk frameworks.
Coordinate on incident response, threat intelligence, and vulnerability disclosure across News Corp businesses.
Share AI security patterns, threat models, and lessons learned with other News Corp businesses, and bring their insights back to Realtor.com.
Use AI to do security work
Build agents that help do the security work: triage findings, investigate alerts, audit IAM for least privilege, and open tested, secure-by-default fix PRs.
Use Claude Code, Devin, and MCP to make the security team faster, and share those patterns with other engineering teams.
Stay ahead of the field
Track new AI threats, incidents, research, and vendor capabilities as they emerge, and turn them into concrete actions for our platform. That includes new attack techniques, model and agent releases, and changes to OWASP, MITRE ATLAS, and other frameworks.
When a major industry incident happens, quickly assess whether we're exposed and lead the response.
Prototype new approaches when existing tools and best practices don't fit yet. Run small experiments, measure the results, and turn what works into platform standards.
Share what you learn: write short internal briefings on major developments and recommend when to adopt, pilot, or skip a new tool or practice.
Educate and lead
Create and run AI security training for engineers, product teams, and the wider company: prompt injection, data leakage, excessive agency, and secure use of tools like Claude, Glean, Devin, and Gemini.
Act as the security voice in AI platform strategy: evaluate vendors and models, set the bar for what's production-ready, and help shape AI governance across the whole AI lifecycle.
Brief leadership on AI risk and where to invest.
Represent Realtor.com externally through conference talks, open-source work, or industry working groups.
What You'll Bring:
8+ years in cybersecurity, cloud security, AppSec/product security, or security platform engineering. Bachelor's degree or equivalent experience.
Hands-on depth in AWS security, plus real experience in GCP (or a strong multi-cloud background).
You know that telling an AI not to do something isn't security. You think in permissions, scopes, logs, approval gates, data boundaries, and rollback.
Experience securing LLM or agentic systems, including prompt injection defenses, retrieval and data-boundary risks, agent identity, and model or tool supply-chain integrity.
Experience doing threat modeling for products and platforms, not just infrastructure. You can lead a session with engineers and product managers and turn it into requirements they'll actually follow.
Hands-on experience building with agents, tool calling, or MCP, and with AI coding tools.
Strong code-review skills in at least one of Python, TypeScript, or Go, and comfort with Terraform/IaC.
Experience with zero trust, least privilege, SSO/OIDC/OAuth, secrets management, and vulnerability management.
Experience working within a larger security organization, such as a parent company, central security team, or federated model. You can balance local speed with alignment to enterprise standards.
Follow AI security research, incident write-ups, and the security community, and you can point to something recent you learned and acted on.
A builder's mindset. You'd rather prototype a new control than wait for a vendor to ship one, and you're comfortable working where the playbook doesn't exist yet.
Explain risk clearly to any audience, from a PR comment to an executive briefing to a training session for the whole company.
Nice to have:
AWS Security Specialty, Google Professional Cloud Security Engineer, CCSP, CISSP, OSCP, or GIAC (GCSA/GWEB).
Experience red-teaming or evaluating AI models or agents.
Familiarity with NIST AI RMF, ISO 42001, Google SAIF, CoSAI, NIST SSDF, or the EU AI Act.
Experience securing Snowflake (RBAC, masking, network policy).
Conference talks, published research, or open-source security contributions.
How We Work:
We balance creativity and innovation on a foundation of in-person collaboration. For most roles, our employees work four or more days in our offices, where they have the opportunity to collaborate in-person, adding richness to our culture and knitting us closer together.
How We Reward You:
Realtor.com is committed to investing in the health and wellbeing of our employees and their families. Our benefits programs include, but are not limited to:
Inclusive and Competitive medical, Rx, dental, and vision coverage
Family forming benefits
13 Paid Holidays
Flexible Time Off
8 hours of paid Volunteer Time off
Immediate eligibility into Company 401(k) plan with 3.5% company match
Tuition Reimbursement program for degreed and non-degreed programs
1:1 personalized Financial Planning Sessions
Student Debt Retirement Savings Match program
Free snacks and refreshments in each office location
Do the best work of your life at Realtor.com®
Here, you’ll partner with a diverse team of experts as you use leading-edge tech to empower everyone to meet a crucial goal: finding their way home. And you’ll find your way home too. At Realtor.com®, you’ll bring your full self to work as you innovate with speed, serve our consumers, and champion your teammates. In return, we’ll provide you with a warm, welcoming, and inclusive culture; intellectual challenges; and the development opportunities you need to grow.
Diversity is important to us, therefore, Realtor.com® is an Equal Opportunity Employer regardless of age, color, national origin, race, religion, creed, gender, sex, sexual orientation, gender identity and/or expression, marital status, status as a disabled veteran and/or veteran of the Vietnam Era or any other characteristic protected by federal, state or local law. In addition, Realtor.com® will provide reasonable accommodations for otherwise qualified disabled individuals.
We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
Apply Now
See All 315+ Staff Security Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find Staff Security Engineer JobsStaff Security Engineer Job Market
Who's Hiring
- ServiceNow14
- Databricks13
- Uber11
- Google11
- GEICO8
Top Industries Hiring
- Technology & Software30
- Insurance5
- Science & Research5
- Banking & Financial Services5
- Fintech4
What Employers Look For
The qualifications that appear most often in staff security engineer jobs.
- 7 or more years of hands-on experience in information security or a related engineering discipline
- Deep expertise in at least one security domain such as cloud security, application security, or detection and response
- Proficiency with cloud platforms including AWS, Azure, or Google Cloud in security contexts
- Relevant certifications such as CISSP, CISM, OSCP, or cloud-provider security specialty credentials
- Experience conducting threat modeling, security architecture reviews, and risk assessments at scale
- Bachelor's degree in computer science, information security, or a closely related technical field
Tips for Your Staff Security Engineer Job Search
Tailor your resume to each security domain
Staff-level security roles are domain-specific, so a resume emphasizing cloud security won't land an appsec interview. Rewrite your summary and top bullet points to mirror the exact security domain each posting calls out, whether that's threat modeling, red teaming, or compliance engineering.
Lead with impact, not tool names
Hiring managers at the staff level expect you to have used standard tools. What they're scanning for is scope: the size of the systems you secured, the risk you reduced, and the teams you influenced. Frame every resume bullet around measurable outcomes, not a list of platforms.
Apply early to roles that fit
Migrate Mate lists staff security engineer openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Filter by security subdomain before applying
Staff security engineer postings vary widely. An identity and access management role requires a completely different preparation than a detection and response position. Narrow your search to your strongest subdomain first, then expand outward once you've exhausted the best-fit openings.
Prepare for a system-design security round
Most staff-level interviews include at least one round where you design a secure system from scratch or audit an existing architecture. Practice drawing out threat models, trust boundaries, and defense-in-depth layers for common scenarios like multi-tenant SaaS or cloud data pipelines.
Negotiate scope, not just compensation
At the staff level, the architecture of your role matters as much as the offer number. Before accepting, clarify which teams you'll influence, whether you have a seat in product and engineering planning, and how security incidents are escalated to your level.
Staff Security Engineer Jobs: Frequently Asked Questions
Which companies are hiring the most staff security engineers?
The most active employers for staff security engineers right now are ServiceNow, Databricks, and Uber, and the most openings are in California, New York, and Washington, based on current listings on Migrate Mate as of November 2026. Demand is especially strong at large technology companies, financial services firms, and government contractors with active security programs.
How many staff security engineer jobs are remote?
About 82% of staff security engineer openings are fully remote or hybrid as of November 2026, making this one of the more flexible roles in engineering. Cloud security and application security positions tend to be the most remote-friendly, while roles tied to on-premises infrastructure or sensitive government systems more often require an on-site presence.
How do you become a staff security engineer?
Start by building deep expertise in one security subdomain, such as application security, cloud security, or incident response, through hands-on engineering roles. Progress through senior security engineer positions where you own cross-team initiatives, mentor others, and contribute to architecture decisions. Earning a recognized certification like CISSP or a cloud security specialty credential strengthens your case for the staff designation, as does a portfolio of large-scale security programs you led end to end.
Can you get hired as a staff security engineer without prior staff-level experience?
Yes, but you'll need to demonstrate staff-level impact in a senior role rather than a matching title. Focus your resume on cross-functional projects you drove, security programs you designed from the ground up, and measurable reductions in organizational risk. Companies often promote strong senior engineers directly to staff when a candidate can show they've already been operating at that scope, even without the official designation.
What does the staff security engineer interview process look like?
The process typically runs four to six rounds and includes a recruiter screen, a technical phone interview covering security fundamentals, a system design or threat modeling session, and a behavioral round focused on leadership and cross-team influence. Some employers add a take-home exercise or a live code review of a vulnerable application. Expect at least one conversation with a senior engineering or security leadership stakeholder about how you'd drive security strategy across the organization.
Where can I find and apply to staff security engineer jobs?
You can find and apply to staff security engineer jobs on Migrate Mate, which lists current openings from across the United States. Search the listings to find roles that match your security domain and experience level, then apply directly to each one that fits.
See All 315+ Staff Security Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find Staff Security Engineer Jobs