Director of Security Engineering

• At Sysdig, we believe cloud security isn't a compromise - it's a promise. From the start, our mission has been clear: to help organizations secure innovation in the cloud, the right way.
• If you have the passion to dig deeper, the desire to challenge convention, and the curiosity to build something better, Sysdig is the right place for you.
• Own security engineering end-to-end. Set the roadmap, standards, and budget for the function. Act as final decision-maker on tooling and practice.
• Build and grow the team. Hire senior and staff security engineers, set their technical direction, and stay close enough to the code to be credible with the engineers you're asking to change how they work.
• Own attack enumeration, detection coverage, and validation as measured disciplines rather than as an annual engagement ending in a PDF.
• Make AI-assisted development safe at our scale. Define what coding agents can touch, what they can commit, and how you'd know if one were subverted by an insider, an external actor, or another agent.
• Use agents to scale the security function itself — triage, control validation, evidence generation, detection authoring. If a security task is repeatable, it should run without the team.
• Build the security champions program across both classical security, and AI security, As a means of scaling and increasing velocity of security across the engineering organization.
• Shape the product roadmap as customer zero. Use new capabilities in production before customers do, then work directly with product on what to build, shape, or stop.
• Represent security externally. Engage major customers on matters of significance, and publish and speak on the work — encouraged, resourced, and supported.
• What you will bring with you
• Have 8+ years in security or software engineering, including 4+ years leading and developing engineers, with real ownership of a team's roadmap, outcomes, and budget
• Have genuine depth in at least two of the four pillars, with working knowledge of all four — we'd rather have real expertise in product and offensive security than a survey of everything
• Have shipped security as code: Terraform or OpenTofu, controls enforced in pipelines, cloud and Kubernetes security at the architectural level rather than the dashboard level
• Have run detection and response for real, as the person on the escalation path rather than above it
• Are already building with agentic tooling and have opinions about where it fails
• Would rather make the secure path the easiest path than enforce it through policy — most of the impact here comes through partnership with Engineering and Product, not mandate
• Are credible with a customer's CISO and with your own engineers, without changing register much between them
• Are energized rather than unsettled by problems where established principles don't fully apply
• What we look for
• Built a security function that didn't exist before, at a company where much of it was theirs to define
• Experience with capable adversaries — APT actors or other sophisticated cyberoffensive groups
• Built or run agent-driven offensive tooling, or automated vulnerability discovery and remediation at scale
• Worked on AI governance frameworks — ISO 42001, the EU AI Act, NIST AI RMF — as an engineering problem rather than a documentation exercise

None flagged.