Requirements

• Experience as the senior security person without a CISO above you; ability to set direction through work, not mandate.
• Hands-on application and API security expertise in a multi-tenant SaaS, ideally with a public API, including authorization models, OAuth/OIDC, session/auth flows, IDOR, SSRF, and threat modeling.
• Proficient in reading and writing TypeScript code and able to ship fixes and review code.
• Led security incidents end-to-end, including status updates, customer communication, and actionable postmortems.
• Experience with AWS, Kubernetes, Cloudflare, or similar to assess infrastructure risk (operation not required).
• Managed or worked closely with SOC 2 or similar compliance programs, preferring automation of evidence collection.
• Handled vulnerability disclosure or bug bounty programs and able to quickly discern real reports from noise.
• Strong, yet flexible opinions with collaborative mindset to find best solutions.
• Fluency with modern AI tools, using them to enhance output and security of AI systems.
• Thrives in remote, async environments with clear communication and follow-through.
• Based between UTC-3 and UTC+3 time zones for team overlap.

Nice to Haves

• Being a Buffer user or familiar with social media management tools.

What You'll Be Doing

• Leading Buffer’s security strategy, setting priorities, driving execution, and improving security culture.
• Building security tooling, automation, and processes with your teammate.
• Embedding security into the development process including PR reviews, threat modeling, dependency management, and supply chain security.
• Advancing operational security while maintaining Buffer’s high-trust environment flexibility.
• Managing daily security operations like inbox triage, team requests, maintenance, and automation.
• Leading security incidents and participating in the on-call rotation; setting incident standards and conducting tabletop exercises.
• Securing AI-related systems and features by threat modeling and setting guardrails.
• Running and evolving the vulnerability disclosure program, triaging and routing reports.
• Owning compliance and customer trust efforts such as SOC 2 and Meta platform compliance, automating evidence, and supporting security questionnaires.

Perks and Benefits

• Fully distributed team with global work environment emphasizing diversity and inclusion.
• Highly encouraged in-person team meetups once or twice per year to build stronger connections.
• Opportunity to work on cutting-edge AI-native projects within a trusted, lean organization.