Lead Security Engineer

The role

We are hiring our first Lead Security Engineer to own application security, cloud security posture, and compliance at 8090. You will report to the CEO and work daily with the CTO and the engineering team. You will secure the 8090 Software Factory and the custom-built applications we deliver through 8090 Enterprise, and you will be the technical counterpart to customer CISOs, CIOs, and system architects in regulated industries.

All jobs

Lead Security Engineer

8090 Solutions Inc, Redwood City

Posted pay

$180K–$350K

a year

Compared with similar jobs

This base pay is above the median for senior security engineering jobs in the Bay Area.

Median: $215K a year
Other jobs in the group: 205

We compare the middle of each posted range. This is base pay as posted. The group does not include this job.

Location: Redwood City
Work type: Onsite
Level: Senior
Experience: 7+ years
Skills in the job text: Python
AWS
TypeScript
GCP
Azure
React
Docker
Terraform
Posted: Sep 5, 2026
Last check: 9 h ago
Job type: Security engineering

Apply on the 8090 Solutions Inc site Sign in to save

The 8090 Solutions Inc site opens in a new tab.

8090 Solutions Inc

Open tech jobs: 5
With posted pay: 40%

About 8090 Solutions Inc: funding, hiring and pay

8090 Solutions Inc

About 8090 Solutions Inc: funding, hiring and pay

Company facts

Money raised: $135MSum of funding rounds on record
Newest round: Series AJun 30, 2026

Funding records can have errors and can be missing. The company page has the links.

Check my fit

Compare your résumé with this job. See where you match, what is missing and which lines to change.

The role

What you will do

Application Security and DevSecOps: Own the secure development lifecycle for the Software Factory and every 8090 Enterprise application. Build and operate SAST, DAST, software composition analysis, secrets detection, and infrastructure-as-code scanning in our GitHub Actions pipelines, with gates that stop critical and high vulnerabilities before release. Set remediation SLAs and drive findings to closure with engineering, prioritizing by exploitability, reachability, data sensitivity, and customer impact rather than scanner severity alone.
Penetration Testing and Disclosure: Perform internal penetration testing of 8090 web applications, APIs, and cloud environments using internally built and custom-off-the-shelf agent harnesses. Scope and direct independent third-party penetration tests, bounty programs, and stand up a vulnerability disclosure channel.
Cloud Infrastructure Security: Own the security posture of our production environments: primarily AWS, with some GCP and occasional Azure deployments. Implement least-privilege IAM, network segmentation, encryption and key management, secrets management, centralized logging assessment and threat detection, backups and recovery, and infrastructure-as-code guardrails in AWS CDK and Terraform so that every customer environment meets CIS Benchmarks and NIST baselines and is isolated from every other. Run continuous posture monitoring and drive remediation.
Security Architecture: Act as the principal advisor in the security design of the Software Factory and 8090 Enterprise applications: authentication and authorization, tenant isolation, data classification and the handling of PII, PHI and other regulated data, audit logging, third-party integrations, customer-specific deployments, and the controls that govern AI agents, including tool-use permissions, prompt injection defenses, and data boundaries. Lead threat modeling and security design reviews.
Compliance Program: Own the controls behind our SOC 1 Type II and SOC 2 Type II reports and keep them audit-ready year round on our compliance automation platform. Design controls for GDPR, HIPAA, and FedRAMP. Select, direct, and hold accountable auditors, assessors, and managed service providers to complete compliance work on schedule, while retaining ownership of scope, evidence accuracy, remediation, and risk decisions. Set the roadmap for the frameworks our customers will require next.
Customer Trust and Sales Support: Partner with sales and go-to-market on customer security reviews, questionnaires, due-diligence requests, RFPs, and procurement reviews. Own the security questionnaire answer library (SIG, CAIQ, and custom) and build our trust center. Present to customer CISOs, CIOs, security teams, and system architects, handle their technical objections with precise explanations of architecture, controls, residual risk, and mitigation, and work with legal on security addenda, DPAs, and BAAs. Feed recurring customer requirements into the product and security roadmaps.
Security Automation with AI: Use AI agents and DevOps automation to remove manual work from application and infrastructure security across customer workloads: evidence collection, vulnerability triage and remediation, questionnaire drafting, posture checks, and detection. Build these automations with the Software Factory and treat them as products. Evaluate every automation before relying on it, and apply least privilege, isolation, logging, tests, and human approval to consequential changes.
Detection and Incident Response: Own the incident response plan and runbooks, run tabletop exercises, and meet the breach notification obligations in our customer contracts and under HIPAA. Run 24x7 monitoring through our managed detection and response partner, own the escalation path, and lead technical response to material events through closure of corrective actions.
Third-Party and AI Supply Chain Risk: Maintain the vendor and subprocessor inventory, run vendor security reviews, and manage the risk from LLM providers, models, and open-source dependencies. Keep an accurate view of assets, attack surface, and privileged access, and partner with IT and Engineering to close high-impact gaps.
Corporate Security Partnership: Partner with the Head of IT on identity and access, endpoint security, zero-trust access, and quarterly access reviews so that corporate controls and production controls hold to the same standard.
Program Leadership: Set the security roadmap, risk register, budget, and metrics. Report material risks, decisions, and progress to the CEO and the leadership team. Make explicit risk decisions that protect customers without creating unnecessary release friction; escalate material exceptions and give every accepted risk an owner and a review date. Build security champions across Engineering and delivery teams, and decide when the function needs its next hire.
Hands-on Engineering: Work directly in the codebase to validate findings, ship fixes, and build secure defaults, reusable libraries, developer tooling, and lightweight internal web applications. Script DevSecOps pipelines and write infrastructure-as-code.

What you need

7 to 10 years of professional IT, DevOps, or application development experience, including at least 3 years in a role where application, cloud, or infrastructure security was a primary responsibility.
Has led security and compliance functions at a technology startup (Series A, B, or C stage).
Hands-on engineer who builds web applications and DevSecOps pipelines and writes infrastructure-as-code. You can read, write, review, test, and ship production web and API code, and you build security tooling rather than only administer vendor products. We use Python, TypeScript, React, GitHub Actions, Docker, AWS CDK, Terraform and AWS.
Application security depth: SAST, DAST, dependency and secrets scanning, CI/CD security gates, threat modeling, vulnerability management, and internal penetration testing.
Cloud, networking, systems architecture, and release-engineering fundamentals, with depth in AWS and the ability to secure or direct work in GCP and Azure.
Experience with infrastructure as code, containers, identity and access management, secrets and key management, logging, detection, and incident response.
Working knowledge of SOC 2, GDPR security requirements, HIPAA safeguards, and FedRAMP mechanics. You have directly implemented and operated controls for SOC 2 and at least one regulated or government environment.
Experience working in a regulated industry (healthcare, financial services, or GovTech) as an IT professional, software engineer, platform engineer, or security engineer.
Experience directing external auditors, security assessors, managed service providers, penetration testers, and compliance or security tooling vendors.
Comfortable in front of customer CISOs, CIOs, security teams, and system architects. You can work credibly with engineers and explain architecture, controls, risk, and tradeoffs to customers and executives.
A record of owning ambiguous problems, learning missing context quickly, and driving work to verified completion, with small internal teams and large, demanding customer organizations.

Lead Security Engineer

The role

Lead Security Engineer

The role

What you will do

What you need

Location

What sets a candidate apart

Expected compensation (us-based employees)

About 8090 Solutions Inc

Similar jobs at other companies