Senior Security Engineer: Engineer the Future of AI-Native Identity Security
C1 is at the forefront of identity security, pioneering the first AI-native platform designed to protect every identity — human, non-human, and AI. With powerful automation, integrated platform-level AI, and extensive out-of-the-box connectors, we empower enterprises like DigitalOcean, Instacart, Ramp, and Zscaler to centralize access visibility, enforce fine-grained controls, enable just-in-time access, and automate user access reviews across all applications. Our platform is renowned for its ease of use, rapid deployment, and unparalleled effectiveness.
Your Mission: Build Security, Not Just Review It
We're seeking a passionate and proactive Senior Security Engineer to join our lean, early-stage security team. This is a pivotal generalist role with a broad remit, encompassing security engineering, application security, cloud security, and compliance. While you'll have the flexibility to deep-dive into a specific domain over time, you’ll remain hands-on and supportive across all areas.
This isn't a manual security job. Instead of sifting through tickets, specs, or deploys by hand, you’ll be an architect of automation. You'll design and build purpose-built agents and skills that continuously orchestrate security throughout the development lifecycle, adopting a sophisticated, risk-based approach. Our core philosophy is to shift security left—baking robust security into design specifications upfront, rather than catching issues in post-deploy reviews.
We're looking for someone who doesn't just identify findings but rolls up their sleeves to help implement systemic fixes. You care deeply about solving problems at their root, not just patching individual instances, and you're driven to make it inherently easier for everyone at C1 to build securely by default. Our primary stack is Go and AWS.
What You'll Be Building and Leading
Define and drive security standards and secure-by-default solutions, serving as a subject matter expert in application and/or cloud security.
Architect and implement purpose-built agents and skills to orchestrate security into the development lifecycle via a risk-based approach, automating manual, repetitive tasks (triage, enrichment, review) so the team can focus on critical judgment calls.
Champion the "shift-left" security paradigm by integrating risk-based reviews directly into design specs and architecture decisions, minimizing reliance on post-deploy audits.
Develop scalable security tooling and automation for engineering teams, and help implement meaningful, actionable security observability and detection signals.
Lead threat modeling and comprehensive risk assessments for high-risk features and critical platform changes.
Assess and mitigate security risks introduced by agentic development practices and AI-powered product features running in production.
Collaborate with engineering teams to prioritize and remediate critical threats, define API security standards, and conduct in-depth security code reviews.
Continuously evaluate and adopt open-source tools to assess and test our services' security, moving beyond manual review.
Identify systemic security risks and lead multi-team remediation efforts end-to-end, from initial recommendation to successful implementation.
Partner across security, compliance, and engineering to solve complex, cross-domain problems, serving as a go-to expert for tough security questions.
Contribute to compliance and trust initiatives (e.g., SOC 2, ISO 27001/42001) as they align with your focus areas.
Invest in the growth of teammates and elevate the security posture across the broader engineering organization.
What You'll Bring to the Team
Proven experience securing enterprise SaaS applications, including expertise in authentication flows, authorization patterns, and input validation at API boundaries.
Demonstrated experience securing deployment and change-management mechanisms for software and infrastructure.
A strong background in Software Engineering, Platform Engineering, Systems Engineering, Network Engineering, Cloud Security, or Application Security.
Hands-on code review experience, ideally in Go, Python, or Rust.
Extensive experience with AWS (or another major cloud provider) and comfort working across cloud infrastructure.
Ability to thrive both independently and collaboratively in a fast-paced, high-growth environment.
A curious mindset, staying current on modern security practices, tooling, and emerging threats, including how AI is reshaping the threat landscape.
Commitment to participate quarterly in-person at one of our primary offices in San Francisco or Portland, Oregon.
Show Us Your Security Automation Prowess A project, demo, or repository where you built an agent, skill, or automation that effectively replaced manual security work (e.g., triage, review, detection). We value practical results and sound judgment in where (and where not) to apply automation, prioritizing impact over mere familiarity with the latest tools. Bonus Points Experience with Kubernetes, service mesh, or advanced PKI/network technologies (e.g., Consul, Envoy, Cilium, Vault, Istio). Why Join C1? Compensation & Benefits ConductorOne, Inc. is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, creed, religion, sex, sexual orientation, national origin or nationality, ancestry, age, disability, gender identity or expression, marital status, veteran status or any other category protected by law.
This role demands real, hands-on experience building agents and automation for security. We believe in showcasing practical results, not just claiming familiarity. As part of your application process, please be ready to share one or more of the following:
Concrete examples of how you integrate AI coding tools or agentic workflows into your day-to-day work.
A concise walkthrough – live or recorded – of a security automation you shipped, detailing the problem it solved, your approach, and its measurable impact.
Proven experience building or extending internal security tooling, automations, or agents.
Prior experience at a high-growth SaaS or identity/access management company.
This is a high-leverage opportunity on a small, impactful security team. Your scope will be broad, your ownership will be genuine, and the systems you build will directly shape how a security-first company secures its own products and development lifecycle. You’ll gain the chance to specialize in your most passionate domain while still contributing across the full breadth of our security program.
C1 offers a competitive salary, meaningful equity, and comprehensive health benefits. Specific compensation will be commensurate with experience.