Staff Security Engineer

About Us Socket helps devs and security teams ship faster by cutting out security busywork. Thousands of orgs use Socket to safely find, audit, and manage open source code. Our customers — from Anthropic to xAI, and Figma to Vercel — love Socket (just check out their tweets https://socket.dev/love to see for yourself!) Founded by Feross Aboukhadijeh https://www.linkedin.com/in/feross/, a long-time open source maintainer with software downloaded over a billion times a month, Socket has raised $ https://socket.dev/blog/series-b125M in funding https://socket.dev/blog/series-c from top angels, operators, and security leaders. About the Role We’re hiring a Security Engineer to help define and scale our security program. This is an IC role with broad ownership across application security, infrastructure, corporate security, and detection engineering. You’ll work hands-on alongside the engineering team, writing code, building internal tooling, and driving meaningful security improvements as we grow. Socket is a security company, and our internal security posture matters both for protecting the company and for the credibility of what we sell. This role is a rare combination: full ownership of a critical function, a company with real traction, and a deeply relevant problem space. As Socket grows, so will the security function, and you'll shape what that looks like. What You'll Do - Improve Socket's security posture across the board. Own, cloud infrastructure hardening, operational security, and IT security. Write code and build tooling that makes the secure path the default path for engineers. Roll out identity and access controls, close gaps across the stack, and continuously reduce risk. - Assess, prioritize, and drive the security roadmap. Figure out what matters most, balance quick wins with longer-term improvements, and execute across many fronts in parallel. You won't wait to be told what to work on. You'll develop a clear picture of where Socket's risks are and make steady progress against them. - Run incident response and external security operations. Build and run a 24/7 security incident response process. Own the security inbox, triage inbound vulnerability reports, manage pentests, and coordinate fixes. When you can fix something directly, you do. - Maintain compliance and drive new certifications. Maintain our existing SOC 2 compliance. Drive new certifications (ISO 27001, etc.) as needed for enterprise customers. - Raise security awareness and culture across the org. Train engineers to write more secure code. Run phishing simulations. Build trust with engineering teams so that security feels like an enabler, not a blocker. Make people want to do the right thing rather than resenting security as a tax. What You'll Bring - You've owned security broadly at a growth-stage company, or you're a strong software engineer who's moved into security and is ready to own the function end-to-end. - You can ship production TypeScript. When the engineering org is heads-down on product work, you unblock yourself by writing code, standing up tooling, and modifying infrastructure rather than filing tickets and waiting. - You have breadth across security domains (AppSec, CloudSec, OpSec) and you're comfortable learning fast where gaps exist. - You're fluent in cloud infrastructure (we use GCP): VPCs, IAM, secret management, networking. - You're a self-directed operator who figures out what matters most and executes across many fronts without waiting to be told what to do. You move fast, find leverage, and get a lot done with a little. - You have the communication and teaching skills to make an entire engineering org care about security, not by blocking people, but by earning trust and making the secure path the easy path. We know how important clarity is when looking for a new role, so we've put together a read-me about the Interview Process at Socket. https://drive.google.com/file/d/131klYMcRGJnuRlEPdSN4MJ4EzCINJTft/view?usp=sharing Benefits