Senior/Staff Security Engineer

Sandbar is hiring a Senior/Staff Security Engineer to own backend security systems that make user privacy real for Stream, working from inside a small backend team on a live production service.

Responsibilities

• Design and ship end-to-end encryption for user data, including key management, while keeping search and background processing working on encrypted data
• Build confidential-computing infrastructure to isolate and verify sensitive processing, including attestation and reproducible builds
• Own identity and secrets across the stack, including short-lived workload credentials, least-privilege service identities, environment isolation, and auditable privileged access
• Own supply chain and CI/CD security
• Build the detection and response loop with audit logging, alerting, runbooks, and post-incident reviews that drive engineering changes
• Drive security for vendors and data handling, including AI provider data agreements, third-party integration and OAuth scope review, plus data retention and deletion
• Lead compliance work (for example, SOC 2) from the engineering side, with controls enforced by systems and evidence generated automatically
• Contribute a share of the core backend, building product features on the real-time Python services you secure and reviewing team changes with a security focus
• Set direction for secure engineering practice through design reviews, threat models, and clear, minimal guidance engineers follow

Requirements

• 7+ years building and operating backend systems, including meaningful time as the engineer accountable for security on a production service
• Strong Python skills and comfort owning a live, real-time service end to end
• Hands-on applied cryptography, including envelope encryption, authenticated encryption, key hierarchies, and understanding practical failure modes
• Deep cloud security experience on AWS and/or GCP, including IAM, workload identity federation, KMS, secrets management, and audit logging
• Experience leading incident response on a production service, from containment through follow-up hardening
• Experience with confidential computing or attestation (e.g. Nitro Enclaves, SEV-SNP, TDX, App Attest) strongly preferred
• Comfortable with document stores and their access-control models
• Ability to make tradeoffs explicitly and ship, understanding differences between controls that gate launch versus controls that can be followed
• Precise communication with engineers, founders, auditors, and vendors

Technologies

• Python
• AWS, GCP
• IAM, workload identity federation
• KMS, secrets management, audit logging
• Nitro Enclaves, SEV-SNP, TDX, App Attest
• OAuth

Benefits

• Health, vision, and dental benefits
• Company-sponsored 401(k)
• Unlimited PTO and sick time
• Early stage equity

Nice to Have

• iOS security primitives (Secure Enclave, Keychain)
• Bluetooth LE device security, firmware signing, or secure pairing
• Experience with retrieval systems or LLM infrastructure and their data-flow controls
• SOC 2 or ISO 27001 audit experience from the engineering side

Location: New York, NY (onsite)
Salary: USD 190,000 - 260,000 per year
Experience: 7+ years