Lead Corporate Security Engineer

Lead the corporate security domain end to end for Suno’s Corporate IT environment, set the standards, and drive roadmap execution.

Responsibilities

• Own corporate security end to end across identity and access governance, endpoint and vulnerability management, detection and response, third-party integration risk, vendor assessment, and SaaS posture
• Build the security team, enable others, and stay hands-on to mature systems, processes, and behaviors
• Set the corporate security roadmap for what to secure, in what order, and to what bar, with buy-in from leadership and XFN stakeholders
• Own Suno’s access model, including RBAC and entitlement design, least-privilege defaults, and the governance layer in Lumos that enforces them
• Define the expected standard for access reviews, certifications, and approvals, then build toward it rather than importing an external framework
• Drive access lifecycle automation so joiner/mover/leaver is correct by default, with exceptions visible
• Develop a model for non-human identity (service accounts, agents, automations) as these accounts represent an increasing share of access
• Own the security standard for the fleet: hardening baseline, compliance signals, device trust, and how endpoint posture informs access decisions
• Own third-party vulnerability management as a program, including coverage, risk-based remediation SLAs, reporting, and negotiation with teams responsible for tooling
• Partner with the IT engineer who owns Kandji to ensure security standards become deployed policy without degrading how people work
• Own EDR deployment and maintenance
• Collaborate with Detection and Response on corporate security incidents until closure
• Own third-party access evaluation: integration and OAuth review for Slack, Google Workspace, and the rest of the portfolio, plus vendor security assessment at purchase and renewal
• Define risk appetite in practice and make it understandable for consistent application by others
• Turn recurring decisions into policy, scope guidance, and tooling so the review queue shrinks as the company grows
• Build and own the SaaS application program, including the bar, assessment cadence, and remediation process
• Improve tenant-level configuration across the portfolio: SSO and SCIM coverage, MFA and session policy, admin role hygiene, OAuth grant and token management, and data sharing defaults
• Work with IT, Security, Engineering, AI Enablement, and Legal to shape how Suno builds and buys
• Influence the scope of next steps, including how GRC plugs in, what to automate versus staff, and where to invest next
• Mentor and raise the technical bar for partners, including those who are not security specialists

Requirements

• ~8+ years in corporate/enterprise security or security engineering, including owning identity, endpoint, or SaaS security as a domain (not only ticket-based work)
• Deep hands-on expertise with a modern IdP and IGA/access-governance tooling (Lumos, Veza, ConductorOne, Opal, or similar)
• Experience designing entitlements/RBAC across a large SaaS portfolio and understanding operational tradeoffs
• Endpoint security depth in a macOS-primary fleet, including MDM-delivered hardening, compliance, device trust, and scaled patch/vulnerability management
• Strong command of OAuth, SAML, OIDC, and SCIM, plus the risk model for third-party integrations
• Proven ability to set a security standard that others can apply without direct enforcement by you (policy, tooling, defaults, or all three)
• Ability to influence engineering and business teams that do not report to you, early enough to change outcomes
• Automation fluency with Python or TypeScript, REST APIs, and a habit of building integrations/internal tooling
• Excellent writing and judgment under ambiguity; able to align with executives and adjust direction based on evidence
• Calibrated sense of risk, including communicating likelihood, impact, and tradeoffs

Technologies

• Lumos, Veza, ConductorOne, Opal, Kandji, EDR, OAuth, SAML, OIDC, SCIM, RBAC, MFA

Compensation

• $165,000 - $220,000 per year

Benefits

• Company equity package
• 401(k) with 3% Employer Match and Roth 401(k)
• Medical, Dental, & Vision Insurance (PPO w/ HSA & FSA options)
• 11 Paid Holidays + Unlimited PTO & Sick Time
• 16 weeks of paid parental leave
• Creative education stipend
• Generous commuter allowance
• In-office lunch (5 days per week)

First 90 Days

• Form an informed view of Suno’s security posture
• Build working relationships with IT engineers and the broader Security team
• Identify the three things the team’s view is wrong about

First 6 Months

• Establish a corporate security roadmap aligned with IT and the CISO
• Make sequencing and tradeoffs explicit
• Ensure highest-risk items are already moving

First Year

• Reduce entitlement sprawl and the vulnerability backlog measurably
• Align detection to real risks
• Keep third-party review fast enough that teams do not route around it
• Sustain the standard through tooling and shared judgment rather than direct involvement

Helpful, Not Required

• Insider risk or DLP programs
• Zero-trust network access
• SOC 2 or ISO program ownership
• Just-in-time access patterns or identity-as-code
• Securing AI agent and non-human identity access
• Experience as the first or second security hire at a fast-growing company

Location and Work Policy

• New York, NY (onsite)
• Expected to work from Suno’s NYC or Cambridge, MA office 5 days per week, per Suno’s policy
• Eligible travel up to 25% to lead team members and support offices across Suno locations
• Deliberate cadence in Cambridge and NYC during the first six months

Additional Notes

• Applicants must be eligible to work in the US
• Full-time employees receive competitive equity packages and comprehensive benefits
• Base salary may vary based on location, skills, qualifications, and experience