171K–223K USD / year
Lead Security Engineer
OtherRemote — UTC-3 to UTC+3
Published on 2026-10-29
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Lead Buffer’s security direction and hands-on work as the company expands its public APIs, AI tools, and internal agent ecosystem. The role combines application and infrastructure security, incident leadership, operational security, and compliance in a small, distributed team.
About the company
Buffer is a social media management platform that helps individuals and businesses streamline their online presence. They provide tools for scheduling posts, analyzing performance, and engaging with audiences across various social media channels.
The team
Security team, working with the existing security engineer and reporting to the Engineering Manager for Infrastructure and Security.
Stack
TypeScriptNode.jsPHPPythonMongoDBGraphQLAWSEKS
What you'll do
- Set security strategy, priorities, standards, and roadmap.
- Build security tooling, automation, and processes.
- Embed security reviews, threat modeling, and dependency and supply-chain hygiene into development.
- Secure AI agents, connectors, and in-product AI features.
- Lead security incidents and participate in the engineering on-call rotation.
- Triage vulnerability disclosures and coordinate fixes.
- Own SOC 2, Meta platform compliance, and customer security requests.
What we're looking for
- Experience as a senior security practitioner setting direction without a CISO above you.
- Hands-on application and API security experience in multi-tenant SaaS, including authorization, OAuth/OIDC, and threat modeling.
- Ability to write and review TypeScript and ship security fixes.
- Experience leading security incidents end-to-end.
- Working knowledge of AWS, Kubernetes, and Cloudflare or similar infrastructure.
- Experience with SOC 2 or a similar compliance program.
- Clear, follow-through-oriented communication in remote, async teams.
Nice to have
- Experience running or triaging a vulnerability disclosure or bug bounty program.
- Fluency with modern AI tools and experience securing AI-enabled systems.
- Familiarity with Buffer or social media management tools.
Benefits
- Equity offered.
Hiring process
- Interviews with the hiring manager and other teammates.
- Asynchronous take-home exercise followed by a discussion.
- Meeting with the CEO.
- Two-day paid collaboration period.