[Hiring] Senior Security Engineer @Kin Insurance

Role Description

You’re the Security Engineer that developers call for advice, and the one who opens the pull request with the fix. Hands-on, cloud-aware, and at home in a codebase.

We’re looking for a Sr Security Engineer with a focus on application security to help us ship fast and ship securely. Security needs to scale with engineering rather than slow it down. In this hands-on role, you’ll:

• Advise developers on secure design.
• Review code and architecture before it ships.
• Fix vulnerabilities and collaborate on hardening systems at the source, across both our applications and our cloud infrastructure.

Your responsibilities include:

• Own vulnerability remediation across engineering, driving findings to resolution and enforcing remediation SLAs.
• Write and ship code to harden Kin systems, working alongside developers to resolve and prevent issues at the source.
• Lead secure code reviews and architecture reviews, identifying risks early and delivering actionable recommendations.
• Partner with developers on dependency and supply chain security, leading the response and hands-on remediation when critical vulnerabilities emerge in third-party packages.
• Build security tooling and automation to scale detection, triage, and remediation.
• Identify and collaborate on remediation of cloud vulnerabilities across AWS environments and Terraform-managed infrastructure.
• Proactively engage engineering teams and lead threat modeling to surface security risks early in the development process.
• Monitor emerging threats across application, code, and AI security, translating them into proactive remediation and guidance for engineering teams.
• Mentor engineers on secure coding practices and drive a security-first mindset across the organization, embedding security into day-to-day development.

Success in this role is about the impact you create. By the end of your first year, you should:

• Feel confident in your role, trusted as an owner, and proud of the progress you’ve helped make.
• Ensure response and remediation SLAs are being met consistently, supported by observability.
• Automate repetitive security work, freeing up more time for improvements.
• Maintain a positive and proactive relationship with engineering teams.
• Proactively harden applications and AWS infrastructure, ensuring new work is shipped securely by default.

Qualifications

• 5+ years of experience in software engineering or security engineering, including at least 1 year focused on security.
• Hands-on proficiency in at least one backend programming language (Ruby strongly preferred).
• Hands-on experience working with SAST/DAST tools in CI/CD pipelines.
• Experience driving vulnerability remediation at scale, including dependency and supply chain vulnerabilities.
• Experience performing secure code reviews, architecture reviews, and threat modeling.
• Hands-on experience securing AWS environments (IAM, VPCs, WAF) and remediating infrastructure-as-code in Terraform.
• Ability to explain security concepts, risks, and tradeoffs clearly to both technical and non-technical audiences.

Requirements

• Strong technical skills in security engineering.
• Proven track record of collaboration with engineering teams.
• Ability to work in a fast-paced environment and adapt to emerging threats.

Benefits

• Competitive salary and company equity through Restricted Stock Units (RSUs).
• 401(k) with company match up to 4% of eligible earnings.
• Multiple medical plan options, plus dental and vision coverage.
• Company-funded HSA contributions (based on medical plan selection).
• Company-paid life insurance and short-term disability.
• A variety of supplemental benefit options, including long-term disability, critical illness, accident, legal, and pet insurance.
• Access to mental health support and confidential counseling resources.
• Flexible PTO for exempt employees (most employees take 15–20 days per year), plus 8 company-observed holidays.
• Paid parental leave, including up to 14 weeks at 100% pay for birthing parents and 8 weeks at 100% pay for non-birthing parents.
• Career mobility and internal growth opportunities across the organization.
• Professional development budgets for certifications, conferences, and learning available, subject to management approval.