Lead Security Engineer - Remote

About the role

A partner company is looking for a hands-on Lead Security Engineer to define and drive security strategy in a fully remote, globally distributed technology organization. The role covers application security, infrastructure protection, compliance and incident management, and works closely with engineering teams to embed security throughout the development lifecycle of an evolving SaaS platform. The position is open to candidates based in Switzerland.

Key responsibilities

• Define and lead the security strategy and roadmap, set standards and drive execution
• Integrate security into the SDLC via pull request reviews, threat modeling, dependency management, secrets detection and supply chain security
• Manage day-to-day security operations, automate manual processes and lead security incidents from detection through resolution, including postmortems
• Take part in the engineering-wide on-call rotation and organize incident response exercises
• Assess and secure AI-powered systems (agents, MCP servers, connectors, in-product AI) through threat modeling
• Manage vulnerability disclosure, assess external reports and coordinate remediation
• Oversee SOC 2 and Meta platform compliance, and support customer trust initiatives such as a Trust Center
• Partner with product engineering teams on technical specifications and security reviews

Required profile

• Senior security engineer or security lead, ideally the most senior specialist in an organization without a CISO above
• Experience leading security incidents end-to-end, including stakeholder communications and postmortems
• Previous experience with vulnerability disclosure or bug bounty programs
• Ability to thrive in remote, asynchronous environments with clear documentation and follow-through

Required skills

• Application and API security in multi-tenant SaaS, with deep knowledge of OAuth, OIDC, authorization models, IDOR, SSRF and threat modeling
• Strong programming, especially TypeScript; PHP and Python are also valued
• Working knowledge of AWS, Kubernetes and Cloudflare, or comparable technologies
• Experience with SOC 2 or similar compliance programs, ideally with automated evidence collection
• Technical environment: Node.js, TypeScript, MongoDB, REST APIs, GraphQL, AWS (EKS, IAM, SQS, S3, CloudFront), Terraform, ArgoCD, GitHub Actions, Cloudflare WAF and Zero Trust, Datadog, Sentry, incident.io, PagerDuty, Vanta, Dependabot, gitleaks, AWS GuardDuty, Action1, 1Password, Google Workspace

What we offer

• Annual base salary of $171,100 to $222,880
• Equity opportunities
• Fully remote work with timezone flexibility (UTC-3 to UTC+3)
• One or two in-person team meetups per year