Sr. Enterprise Security Engineer

About the role

Material protects Google Workspace for its customers and wants to make its own corporate environment equally secure. The role takes a mature security program and makes it rigorous and adapted to LLM-based security tooling, so the company can detect and defend against sophisticated attacks. It is a remote-first workplace with an office in San Francisco.

Key responsibilities

• Detection and response: own corporate telemetry and detection content, close coverage gaps, reduce noise, and build detections for account takeover, session token theft, malicious OAuth grants, admin abuse and exfiltration; lead incident response and own the playbooks.
• LLM-driven triage: design and build an agent that reviews privileged access grants, customer data access and high-fidelity endpoint and identity alerts in near real time, with labeled evaluation sets, measured precision and recall, explicit limits on automated action and protection against log or employee influence.
• Endpoint (shared with CorpSec): device management and EDR for the Mac fleet, automated update enforcement, deeper EDR coverage, browser-level DLP and BYOD posture on iOS and Android.
• Identity and SaaS (shared with CorpSec): phishing-resistant authentication, apps without SSO, automated access-review evidence and a pipeline for vendor and OAuth application review.
• Google Workspace (shared with CorpSec): admin alerting, OAuth governance, Apps Script governance, sharing and DLP, partnering with Engineering to ship detection updates to the product.
• Corporate to production (shared with AppSec): detections crossing the boundary, just-in-time access and logging of who touched what.

Required profile

• 6+ years in corporate or enterprise security or detection and response, with hands-on ownership of a SIEM, detection content and incident response.
• End-to-end ownership of devices, identity, SaaS and collaboration, treating them as one system and hardening the paths between them.
• Has written detections that caught real attacks, responded to live incidents and knows what to revoke first.
• Builds systems instead of repeating manual work, and has put an LLM into a security workflow with measured views on where it should and should not be trusted.
• Bonus: a published technical paper, a conference talk or open-source security tooling.

Required skills

• Comfortable in Python, Go or TypeScript working directly against vendor APIs.
• Deep understanding of OAuth, SAML/OIDC, session and token lifecycle and cloud IAM.
• Managed a Mac fleet with a modern MDM and EDR, moving it from deployed to enforced.
• Nice to have: contributed detection logic or security features to a product codebase and worked inside an engineering team's review and release process.