Member of Technical Staff, Security

We're hiring a Security Engineer to join our Security Engineering team. You'll own technical security controls across our platform, cloud infrastructure, and corporate environment, with a focus on detection and response / application security / cloud and IAM / vulnerability management. You'll work daily with Engineering, Infrastructure, IT, and our GRC team to keep controls effective as we scale.

This role fits someone who treats security as a business accelerator and prefers building and improving systems over auditing them.

In your first 90 days, you'll learn our environment, take ownership of a focus area, and work with Infrastructure to close the highest-risk gaps in our AWS environment. You'll also tune our existing CI/CD and cloud scanning so findings are accurate, prioritized, and fixed on schedule.

Over time, you'll take on broader responsibility

• Run and mature our vulnerability management program across infrastructure, applications, and dependencies, including triage, severity-based remediation targets, and exception handling
• Triage and respond to findings from automated tooling, bug bounty reports, and third-party assessments
• Enforce least-privilege access and run regular access reviews across environments
• Work with Infrastructure to improve detection and monitoring using log aggregation and SIEM tooling
• Provide engineering evidence (scans, access reviews, hardening) that supports continuous SOC 2 compliance, working with our GRC team
• Support customer security reviews by answering technical questions from enterprise buyers
• Lead post-incident reviews and drive systemic fixes
• Contribute to risk assessments and the risk register, and help set priorities

Must have

• 5+ years in security engineering, including time in high-growth SaaS or infrastructure-heavy environments
• Experience supporting or maintaining a SOC 2 program
• Strong knowledge of AWS security services and cloud security architecture (IAM, VPC, CloudTrail, GuardDuty, Security Hub)
• Solid understanding of identity and authentication protocols (OAuth, SAML, OIDC)
• Scripting skills in Python or Bash to automate security workflows

Who you are

• A clear communicator who can explain security risk in business terms to engineers, leadership, and customer-facing teams
• A systems thinker who reasons about root causes, blast radius, and scalable control design
• Self-directed, with sound judgment, and effective as part of a team that shares ownership of the program
• Motivated to strengthen the security program of a category-defining AI company

• Experience running vulnerability management and security scanning (SAST, DAST, SCA, container scanning) in CI/CD workflows
• Infrastructure-as-code security experience (Terraform, CloudFormation)
• Familiarity with network security fundamentals (firewalls, DNS, VPNs, segmentation, traffic analysis)
• Background in penetration testing, application security assessments, or CTF competitions
• Familiarity with data infrastructure security for systems like ClickHouse or PostgreSQL
• Experience with data processing compliance in analytics-heavy environments
• Relevant certifications (CISSP, CCSP, AWS Security Specialty, or similar)

The expected base salary range is $200,000 to $250,000 (NYC). Total compensation includes base salary, equity, and a full range of benefits and perks. Final compensation depends on skills, experience, qualifications, and location, and is set during the interview process. Our recruiting team will share the full package as you move through hiring.

Note: All official communication from Profound will come from a @tryprofound.com email address. If you're contacted by anyone using a different domain, please disregard and report it as spam.

Profound is the fastest-growing AI marketing platform, used by 15% of the Fortune 500 including Comcast, Estée Lauder, and Walmart, and innovators like Ramp, MongoDB, and Figma. It is where marketing teams do the work: research, briefs, content, campaigns, reporting, all in one place, alongside agents that carry the load with them.

Built on 2B+ real user prompts and growing, Profound’s data shows you what people ask AI and what the models say back. Profound's AI Marketer joins that data with deep context about our customers to find the opportunities worth acting on, and then puts agents to work: automating reporting, drafting content, auditing pages for readability, running competitive research. It measures what works and gets better every day.

As enterprises put AI into critical workflows, they need to trust the platforms they rely on. Profound is SOC 2 Type II certified and sells to security-conscious enterprises, so the security program behind that claim has to keep up with growth.