Senior/Staff Security Engineer

Sandbar is seeking a Senior/Staff Security Engineer to take ownership of backend systems that make user privacy operational for Stream. This role sits inside a small backend team supporting a live production service, with security delivered through engineering decisions across encryption, identity, detection and response, and compliance tooling.

Responsibilities

• Design and ship end-to-end encryption for user data, including key management, while ensuring search and background processing continue to function over encrypted data.
• Build confidential-computing infrastructure to isolate and verify sensitive processing, including attestation and reproducible builds.
• Own identity and secrets across the stack, including short-lived workload credentials, least-privilege service identities, environment isolation, and auditable privileged access.
• Own supply chain and CI/CD security.
• Develop the detection and response loop, including audit logging, alerting, runbooks, and post-incident reviews that result in engineering changes.
• Lead vendor and data-handling security work, including AI provider data agreements, third-party integration and OAuth scope review, and data retention and deletion practices.
• Drive compliance efforts from the engineering side (for example, SOC 2), ensuring controls are enforced by systems and evidence is generated automatically.
• Share responsibility for core backend delivery by building product features on real-time Python services, and reviewing team changes with a security focus.
• Set direction for secure engineering practice through design reviews, threat models, and minimal guidance that engineers can consistently apply.

Requirements

• 7+ years building and operating backend systems, including substantial experience where you were directly accountable for security on a production service.
• Strong Python skills and comfort owning a live, real-time service end to end.
• Hands-on applied cryptography experience, including envelope encryption, authenticated encryption, key hierarchies, and the practical issues that can undermine correct designs.
• Deep cloud security experience on AWS and/or GCP, including IAM, workload identity federation, KMS, secrets management, and audit logging.
• Experience leading incident response on a production service, from containment through follow-up hardening.
• Experience with confidential computing or attestation is strongly preferred (for example: Nitro Enclaves, SEV-SNP, TDX, App Attest).
• Comfort working with document stores and their access-control models.
• Ability to make tradeoffs explicitly and ship, including understanding the difference between controls that gate a launch and controls that can be followed post-launch.
• Precise communication with engineers, founders, auditors, and vendors.

Technologies

• Python
• AWS, GCP
• IAM, workload identity federation
• KMS, secrets management, audit logging
• Nitro Enclaves, SEV-SNP, TDX, App Attest
• OAuth

Benefits

• Health, vision, and dental benefits
• Company-sponsored 401(k)
• Unlimited PTO and sick time
• Early stage equity

Nice to Have

• iOS security primitives (Secure Enclave, Keychain)
• Bluetooth LE device security, firmware signing, or secure pairing
• Experience with retrieval systems or LLM infrastructure and their data-flow controls
• SOC 2 or ISO 27001 audit experience from the engineering side

Position Details

• Location: New York, NY (onsite)
• Salary: USD 190,000 - 260,000 per year
• Minimum experience: 7 years