7 days ago
Remote, Americas or Remote, EMEAStaff+
Base Salary
$171k - $223k/yr
Responsibilities
- Define Buffer’s security strategy, roadmap, priorities, standards, and execution.
- Build security tooling, automation, and processes with the Security team.
- Integrate security into development through PR checks, threat modeling, dependency management, secrets management, and supply-chain hygiene.
- Advance operational security while maintaining Buffer’s high-trust environment.
- Lead security incidents, participate in the engineering-wide on-call rotation, run tabletops, and drive post-incident improvements.
- Threat-model and establish guardrails for AI agents, connectors, MCP servers, and in-product AI.
- Run vulnerability disclosure activities, triage external reports, and manage bug bounty-related work.
- Own SOC 2, Meta platform compliance, security questionnaires, evidence automation, and customer trust initiatives.
Requirements
- Experience as the senior security person at an organization without a CISO above you, including setting direction through influence.
- Hands-on application and API security experience in a multi-tenant SaaS environment, including authorization, OAuth, OIDC, session and authentication flows, IDOR, SSRF, and threat modeling.
- Ability to write, read, and modify TypeScript code; legacy PHP and Python experience is relevant.
- Experience leading security incidents end-to-end, including status updates, customer communications, and actionable postmortems.
- Experience with AWS, Kubernetes, and Cloudflare, or similar technologies, sufficient to assess infrastructure risk.
- Experience running or supporting a SOC 2 or similar compliance program and automating evidence collection.
- Experience running or triaging a vulnerability disclosure or bug bounty program.
- Fluency with modern AI tools and experience securing systems that use them.
- Ability to work effectively in remote, asynchronous environments and communicate clearly in writing.
- Familiarity with social media management tools or being a Buffer user is a bonus.
Benefits
- Fully distributed work environment with candidates currently accepted between UTC-3 and UTC+3.
- In-person team gatherings once or twice per year are highly encouraged.
- Two paid collaboration days working with the team on a real project during the hiring process.
- Participation in a remote, asynchronous work culture with written communication and flexible high-trust practices.
Tech Stack
Categories
About Buffer
Buffer builds a social media management platform for creators and businesses to plan, publish, and analyze posts across Instagram, TikTok, Facebook, LinkedIn, Pinterest, X, and YouTube. It sells subscriptions (with a freemium option) to tools for scheduling, analytics, engagement, and link-in-bio pages, delivered as SaaS. Founded in 2010 and headquartered in San Francisco, Buffer is privately held and operates a fully distributed team with a public transparency dashboard.