Senior/Staff Security Engineer

ngrok builds developer infrastructure for connecting services and AI models. The Senior/Staff Security Engineer will establish and own the security engineering program, building automated safeguards, developer-facing security tooling, and detection and response capabilities across the product and infrastructure.

Responsibilities:

• Audit the current state of security tooling, pipeline coverage, cloud posture, and detection capabilities, and turn that into a prioritized security roadmap tied to ngrok's business objectives
• Ship developer-facing security tooling: automated checks in CI/CD, secrets scanning, dependency vulnerability tracking, and secure-by-default libraries that make the right choice the easy choice
• Run a structured risk assessment across product and infrastructure to document what we know, what we don't, and what needs to change
• Establish guardrails for how we use AI in our engineering pipeline — policies and tooling that let us move fast without introducing new risk classes
• Stand up baseline detection and response: log coverage, alerting, and a documented incident response process
• Own the security engineering program end-to-end over time — clear ownership, documented controls, meaningful metrics, and an internal security platform (reusable libraries, self-service tooling, automation) that reduces the security burden on every engineer

Requirements:

• You've worked in a security engineering role where you shipped tooling, built automation, or owned security infrastructure — not just reviewed it
• You have strong engineering fundamentals and are comfortable writing quality code in Go or Java, Rust, C, C++
• You've built internal security platforms or developer-facing security tooling
• You know how to integrate security checks into CI/CD pipelines without slowing teams down
• You have hands-on experience with cloud security, particularly AWS (IAM, VPC, CloudTrail, GuardDuty)
• You understand AI/ML security risks like prompt injection, insecure code generation, and LLM-assisted attack vectors
• All candidates must be US-based, and legally authorized to work in the United States
• Applicants must be authorized to work in the United States on a permanent, ongoing basis without the need for current or future sponsorship
• You've done detection engineering — writing detection rules, tuning signals, reducing alert fatigue
• You've secured networking or developer infrastructure products