Sr. Enterprise Security Engineer

Material Security · Remote, United States

Material works with some of the most sophisticated security teams in the industry. These customers have entrusted us with protecting one of their most critical assets: Google Workspace. This includes hardening our corp services, increasing detection efficacy while reducing response times, and making sure our employees are working with customer data in ways that reflect the trust of our customers

Concretely: bring your experience to identify and close gaps in our environment, rebuild our detection and response around LLMs — and be customer zero for our own product, working with Engineering to turn what you learn into detection improvements that ship to every customer.
Mac-only fleet, Google Workspace, expected security services like a SIEM, IdP, EDR, fleet management and a cloud production environment. You treat the IdP, the device fleet, and the SaaS estate as one system, and you harden the paths between them rather than each tool in isolation.
Bonus: you have written a technical paper, spoken at a technical conference, or maintain open-source security tooling.
Detection and Response (own) : Own corporate telemetry and the detection content on it. Close coverage gaps, reduce noise with measured fidelity, and build detections for what matters here: account takeover, session token theft, malicious OAuth grants, admin abuse, and exfiltration by someone who legitimately has access. LLM-Driven Triage (own) : Design and build the agent that reviews privileged access grants, customer data access, and high-fidelity endpoint and identity alerts in near real time, with labeled evaluation sets, measured precision and recall, explicit limits on automated action, and a defense against being steered by log content or an employees reply.
Endpoint (shared with the CorpSec team) : Device management and endpoint detection for the Mac fleet. Automate update enforcement, deepen EDR coverage, bring browser-level DLP to the fleet, and enforce BYOD posture on iOS and Android.
Maintain phishing-resistant authentication everywhere, address the applications that cannot do SSO, automate access-review evidence, and turn manual vendor and OAuth application review into a pipeline.
Google Workspace (shared with the CorpSec team) : Admin alerting, OAuth governance, Apps Script governance, sharing, and DLP, using our own product where it fits. Partner with Engineering to propose, test, and ship detection updates to the product based on what you see in our own tenant.
Operator Depth

: 6+ years in corporate or enterprise security or detection and response, with hands-on ownership of a SIEM, detection content, and incident response.
Software Engineering

: Comfortable in Python, Go, or TypeScript working directly against vendor APIs. Deep understanding of OAuth, SAML/OIDC, session and token lifecycle, and how identity reaches cloud IAM.
Endpoint Fluency: You have managed a Mac fleet with a modern MDM and EDR and taken it from deployed to enforced.
Software Development (nice to have) : You have contributed detection logic or security features to a product codebase and are comfortable working inside an engineering teams review and release process.

You work well next to more junior engineers without taking over, and you would rather engineer a problem away than staff it.

Material Security is a remote-first workplace with an office in San Francisco, California.
By clicking "Apply for this Job", you acknowledge that you have read the

California Candidate Privacy Notice Regarding Use of Personal Information

and hereby agree to its terms.
Compensation at Material Security is determined by a range of factors, including but not limited to the individual’s particular combination of knowledge, skills, competencies, and experience. The projected compensation range for this position is $220,000-$240,000 annually.
Material Security is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. We do not discriminate on the basis of race, color, religion, creed, national origin, ancestry, sex, gender, gender identity or expression, sexual orientation, age, marital status, veteran status, disability, genetic information, or any other legally protected status.