Sr. Enterprise Security Engineer

The role

The candidate will harden the corporate environment and rebuild detection and response around LLMs. They will act as customer zero for the company's own product to improve detection capabilities.

What you will do

• Own corporate telemetry and detection content
• Close coverage gaps and reduce noise
• Lead corporate incident response and own playbooks
• Design and build an agent for LLM-driven triage of privileged access and alerts
• Manage device management and endpoint detection for the Mac fleet
• Automate update enforcement and deepen EDR coverage
• Maintain phishing-resistant authentication and manage the SaaS estate
• Manage Google Workspace admin alerting, OAuth governance, and DLP
• Partner with Engineering to ship detection updates to the product
• Manage the boundary between corporate and production

Required qualifications

• 6+ years in corporate or enterprise security or detection and response
• Hands-on ownership of a SIEM, detection content, and incident response
• Comfortable in Python, Go, or TypeScript working directly against vendor APIs
• Deep understanding of OAuth, SAML/OIDC, session and token lifecycle, and how identity reaches cloud IAM
• Managed a Mac fleet with a modern MDM and EDR
• Built or seriously experimented with LLM-driven workflows, including prompting, tool use, and evaluation

Nice to have

• Written a technical paper
• Spoken at a technical conference
• Maintain open-source security tooling
• Contributed detection logic or security features to a product codebase

About the company

Material Security is a remote-first workplace with an office in San Francisco, California. They work with sophisticated security teams to protect critical assets like Google Workspace.