Staff Software Engineer (Product Security)

• Security Platform Engineering:
• Design and implement scalable infrastructure supporting HIPAA, SOC 2, and ISO 27001 compliance
• Build and maintain systems for identity, authentication, and access management (Okta / GCP IAM / Auth0/ OPA)
• Implement observability and anomaly detection across microservices, data stores, and SaaS platforms
• Establish Zero Trust principles and enforce least-privilege access company-wide
• Develop compliance observability dashboards and automated evidence collection
• Security Automation & Tooling:
• Create self-service security tools that integrate with developer workflows (GitLab CI/CD, Terraform)
• Automate onboarding/offboarding, access reviews, and approvals
• Integrate software-supply-chain security (SBOM, dependency scanning)
• Develop or adopt AI-assisted security tooling to proactively identify risks
• Automate policy enforcement, SAST/DAST scans, and compliance verification
• Application & Data Security:
• Lead threat modeling and security architecture reviews for new products and services
• Partner with product and data teams to embed secure-by-default design patterns
• Ensure encryption, access tracking, and secure data handling across PHI workflows
• Contribute to incident response, post-mortems, and continual improvement of security posture
• Leadership & Collaboration:
• Act as Maven’s technical authority for security engineering
• Mentor peers and promote secure coding and architecture practices
• Partner cross-functionally (Engineering, Compliance, Clinical, Legal) to align on security strategy
• Champion an engineering culture of transparency, accountability, and continuous improvement

Benefits

• 401K matching for US-based employees (immediately vesting)
• 16 weeks 100% paid parental leave, flexible time upon return, and $1.5K/mo for 2 months, new parent stipend (for Mavens who’ve been with us at least six months)
• Annual professional development stipend and access to a personal career coach through Maven
• Maven for Mavens: access to the full platform and specialists, including care for everything from mental health, reproductive health, family planning, pediatrics
• Whole-self care through wellness partnerships
• Weekly breakfast, lunch, and get-togethers

• Experience with Kubernetes, containers, and infrastructure-as-code (Terraform)
• Excellent communication and documentation skills
• Deep understanding of cloud security (GCP preferred; AWS/Azure welcome)
• 8+ years of software engineering experience, including 3+ in security infrastructure or application security
• Proven ability to design and implement large-scale, distributed, cloud-native systems
• Strong coding proficiency in Python, TypeScript, Go and/or Rust
• Familiarity with security testing frameworks and secure SDLC principles
• Experience with security compliance automation (SOC 2, ISO 27001, PCI-DSS, NIST)
• Expertise in Zero Trust architectures, authentication/authorization frameworks, and data-loss prevention
• Background in data security telemetry and threat detection
• Familiarity with AI/ML security and AI-assisted analysis tools
• Exposure to supply-chain security and CI/CD pipeline hardening
• Certifications (CISSP, GCP Professional Cloud Security Engineer, OSCP) a plus
• You’re curious, adaptable, and eager to lead initiatives from concept to production
• You communicate clearly with both technical and non-technical stakeholders
• You balance rigor with velocity, enabling teams to move quickly without compromising trust
• You care deeply about our mission—building safer, smarter healthcare for women and families
• You take a pragmatic, automation-first approach to solving security problems