{"id":3836476,"url":"https://alion.io/job/buffer-lead-security-engineer","title":"Lead Security Engineer","company":{"id":7234,"name":"Buffer","domain":"buffer.com","url":"https://alion.io/company/buffer","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_regions","remote_scope_basis":"inferred_payroll_markers","remote_working_hours":{"label":"UTC-3 – UTC+3","utc_offset_min":-3,"utc_offset_max":3},"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["DE","FR","GB","AT","BE","BG","HR","CZ","DK","FI","HU","IE","IT","NL","NO","PL","RO","ES","SE","CH","EE","GR","IS","LV","LI","LT","LU","MT","PT","SK","SI"],"hiring_countries_total":31,"salary":{"min":171100,"max":222880,"currency":"USD","period":"year","gross":null,"usd_annual":222880},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Claude","optional":false},{"name":"Cloudflare","optional":false},{"name":"GraphQL","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"PHP","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Amazon EKS","optional":true},{"name":"Amazon S3","optional":true},{"name":"ArgoCD","optional":true},{"name":"Cloudflare WAF","optional":true},{"name":"Datadog","optional":true},{"name":"Dependabot","optional":true},{"name":"DNS","optional":true},{"name":"GitHub Actions","optional":true},{"name":"Gitleaks","optional":true},{"name":"Google Workspace","optional":true},{"name":"IAM","optional":true},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true},{"name":"PagerDuty","optional":true},{"name":"Sentry","optional":true},{"name":"Terraform","optional":true},{"name":"Zero Trust","optional":true},{"name":"Zoom","optional":true}],"status":"live","first_seen_at":"2026-10-29T21:32:06Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-11-07T00:10:46Z","board_verified":true,"closed_at":null,"days_open":8,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":8},"description":"About Buffer\nWe create social media and brand-building software for small businesses, creators, and individuals. Our mission is to provide essential tools to help small businesses get off the ground and grow. Through exceptional customer service and uplifting content, we help our customers believe they can succeed and do good along the way.\nBuffer is a fully distributed team, and we’ve always aimed to do things a little differently. Since the early days, we’ve focused on building one of the most unique and fulfilling workplaces by rethinking a lot of traditional practices. We also default to transparency, so you can read all about our metrics, and our successes and failures along the way on our Transparency Dashboard.\nWe're united by Buffer's values, and we hire and work from all over the world. We strive to create a diverse and inclusive work environment, and we are building a culture where underrepresented groups are welcome and can flourish. Please note that we do travel to work together in person once or twice per year, and those events are highly encouraged to build deeper connections among our small team.\nAs you get to know Buffer and consider joining the journey, you can learn more about Buffer on our Journey page. Still curious to learn more about the experience on the Buffer team? Feel free to read more from Kirsti and Sabreen as they share their first experiences with Buffer, as well as from Hailley, who captured why she still calls Buffer home after 8+ years.\nWhile unusual at Buffer, we're looking for folks in a specific timezone range. This role is currently open to candidates based between UTC-3 and UTC+3. That gives you overlap with our current security engineer in Sri Lanka and most of our Engineering team, and lets the two of you share incident coverage so neither of you has to work through the night.\nAbout the role\nWe're hiring a hands-on security engineer to be the tech lead for Buffer's Security team. You'll work alongside Adnan, who has carried security at Buffer for years. Together, you’ll own security and compliance for a 15-year-old profitable company that is rebuilding itself around AI.\nTwo things make this the right moment. Buffer’s product surface is growing: in May, we launched a public GraphQL API with an MCP server and CLI. More than 35,000 organizations have connected an AI tool to Buffer, and we are planning to build a plugin ecosystem on top. Internally, we're becoming an AI-native organization: MCPs on our Claude Team plan, custom connectors, internal tools, and Roo, our own internal agent. We're small and lean, with few processes, and we run on trust around access and permissions. We don't want to lose that, but the surface now grows faster than one person can cover.\nThat means the usual security playbook won't work here. We don't buy enterprise plans for every tool, and we don't make people justify every access request. You’ll make the secure path the easy path to follow.\nYour role will be to set the direction for security at Buffer and to do much of the work yourself. You'll decide which open security problems to address first, write code to fix some of them, and lead incidents when they happen. We're looking for an enabler and a team player, not a gatekeeper. This is a generalist role by design.\nWho you’ll work with\nYou’ll report to Miguel, Engineering Manager for the Infrastructure and Security teams.\nDay-to-day, the Security team is you, Adnan, and Miguel. Adnan knows how everything at Buffer fits together and where the sharp edges are. Together, you’ll own planned security work as well as the work that keeps the lights on: the security inbox, requests from other teams, maintenance, and chores. You’ll lead the team’s direction and standards.\nYou will also work closely with product engineering teams to ensure that what we build meets a strong security bar. That means collaborating on tech spec reviews and growing the group of security champions across the teams.\nYour peers from our Advocacy (customer support) and People teams will rely on you to support them with security and compliance needs that come up in their work, from customer security questions to vendor reviews and policy.\nWhat you’ll be working on\nLead security at Buffer. Define the strategy and roadmap, set priorities, drive execution, and change how we work where it matters. If you see a problem outside your lane, say so and drive the fix.\n\nBuild. Identify the problem, define the solution, then build it with Adnan: tooling, automation, processes.\n\nPut security in the development loop. Check on every PR, threat modeling in tech specs, dependency, secrets, and supply chain hygiene, and review steps that hold up as more of our code is written with AI agents.\n\nAdvance operational security. Secure our day-to-day operations to meet industry-wide standards while maintaining the flexibility afforded by Buffer’s high-trust environment.\n\nKeep the lights on. Security inbox, requests from other teams, maintenance and chores, shared with Adnan. Much of this is manual today, and we’d love you to automate what you can.\n\nLead incidents and take part in our engineering-wide on-call rotation. Set the standard for how we run a security incident, then hold the team to it. Run tabletops with the rest of Engineering, and ensure the gaps are fixed.\n\nSecure the AI surface. Threat-model what we’re building, from agents with tool access to connectors and in-product AI, and set guardrails so Buffer can move fast on AI without guessing.\n\nRun vulnerability disclosure. Triage reports from outside researchers, fix or route the real ones, and decide how the program grows.\n\nOwn compliance and customer trust. SOC 2 and Meta platform compliance are the big ones today. We want them to make Buffer safer, not only to pass audits, but also to automate evidence where you can. Security questionnaires reach us through Advocacy. Help answer them, and build what lets customers find answers on their own (a Trust Center, for example).\n\nHelpful skills and experience\nYou’ve been the senior security person somewhere without a CISO above you. You know what it means to set direction without a mandate and earn it through work.\n\nYou have hands-on application and API security depth in a multi-tenant SaaS, ideally one with a public API: authorization models, OAuth and OIDC, session and auth flows, IDOR and SSRF, and threat modeling. You've found these bugs and fixed them, not only reported them.\n\nYou write code. You can read and change a TypeScript codebase well enough to ship a fix and review someone else’s (legacy PHP and Python show up more rarely, too).\n\nYou’ve led security incidents end-to-end, including the writing of status updates, customer comms, and postmortems that people act on.\n\nYou’ve worked with AWS, Kubernetes, and Cloudflare, or similar, enough to reason about infrastructure risk with an infrastructure team. You don’t need to run it.\n\nYou’ve run a SOC 2 or similar program, or worked closely with one, and you’d rather automate evidence collection than do it by hand.\n\nYou've run or triaged a vulnerability disclosure or bug bounty program, and you can tell a real report from noise quickly.\n\nYou have strong opinions, and you can hold them loosely. You are comfortable disagreeing with a senior engineer’s design, and working together to find the best solution (sometimes changing your mind when their argument is better).\n\nYou’re fluent with modern AI tools, and you use them to multiply your output and your team’s. You’ve thought hard about securing systems that use them.\n\nYou thrive in remote, async environments, and you follow through. You're clear in your thinking and generous with context, and you close the loop on what you commit to. Most of your influence here will be written.\n\nBonus points if you’re already a Buffer user or familiar with social media management tools.\n\nOur tech stack\nProduct. Node.js (TypeScript) across most services in a monorepo, backed by MongoDB; a REST API and PHP being retired for legacy services. iOS and Android apps. A public GraphQL API, MCP server, CLI, and connectors.\n\nInfrastructure. AWS (EKS, IAM, SQS, S3, CloudFront), Terraform, ArgoCD, GitHub Actions, Cloudflare (WAF, Zero Trust, Workers, DNS).\n\nSecurity and compliance. Vanta for SOC 2, Dependabot, gitleaks, AWS GuardDuty, Cloudflare WAF and Zero Trust, Action1 for device management, 1Password, and Google Workspace as the identity layer.\n\nObservability and incidents. Datadog, Sentry, incident.io, and PagerDuty.\n\nAI. Claude Team across the company, internal agents and MCP servers built in-house, in-product AI features.\n\nApply for the job\nDo you believe you're a fit for this role and want to join the Buffer team? We'd love to hear about you!\nHere's what our hiring process looks like:\nApplication. A short form with your CV, LinkedIn, a few yes/no questions, and an example of your writing.\n\nQuestionnaire. If there’s a match, we’ll email you a short set of questions to learn a bit more about you!\n\nInterview process: Meet with several teammates across a few Zoom calls, starting with Miguel, Engineering Manager for Infrastructure and Security, and the hiring manager for this role, and then a handful of other Buffer teammates and peers.\n\nTake-home exercise. During our interview process, we'll ask you to do an asynchronous task so we can see your work in practice and discuss it live.\n\nMeet the CEO. Get to know Joel, our Founder CEO.\n\nCollaboration period. Two paid days working with the team on a real project, so that we can each see what it's like to work together.\n\nPrivacy Policy\nBy submitting the application, you consent to Buffer collecting and processing your personal data for recruiting purposes. Find more details in our Privacy Policy.","description_format":"text","description_chars":9761,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Germany","iso":"DE","kind":"region"},{"name":"France","iso":"FR","kind":"region"},{"name":"United Kingdom","iso":"GB","kind":"region"},{"name":"Austria","iso":"AT","kind":"region"},{"name":"Belgium","iso":"BE","kind":"region"},{"name":"Bulgaria","iso":"BG","kind":"region"},{"name":"Croatia","iso":"HR","kind":"region"},{"name":"Czech Republic","iso":"CZ","kind":"region"},{"name":"Denmark","iso":"DK","kind":"region"},{"name":"Finland","iso":"FI","kind":"region"},{"name":"Hungary","iso":"HU","kind":"region"},{"name":"Ireland","iso":"IE","kind":"region"},{"name":"Italy","iso":"IT","kind":"region"},{"name":"Netherlands","iso":"NL","kind":"region"},{"name":"Norway","iso":"NO","kind":"region"},{"name":"Poland","iso":"PL","kind":"region"},{"name":"Romania","iso":"RO","kind":"region"},{"name":"Spain","iso":"ES","kind":"region"},{"name":"Sweden","iso":"SE","kind":"region"},{"name":"Switzerland","iso":"CH","kind":"region"},{"name":"Estonia","iso":"EE","kind":"region"},{"name":"Greece","iso":"GR","kind":"region"},{"name":"Iceland","iso":"IS","kind":"region"},{"name":"Latvia","iso":"LV","kind":"region"},{"name":"Liechtenstein","iso":"LI","kind":"region"},{"name":"Lithuania","iso":"LT","kind":"region"},{"name":"Luxembourg","iso":"LU","kind":"region"},{"name":"Malta","iso":"MT","kind":"region"},{"name":"Portugal","iso":"PT","kind":"region"},{"name":"Slovakia","iso":"SK","kind":"region"},{"name":"Slovenia","iso":"SI","kind":"region"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Custom Software Development","Blogging & Newsletter Platforms"],"lifecycle":[{"event":"open","at":"2026-11-05T21:13:41Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":7,"expected_fill_days":34,"reasons":["conf:4","win:early"],"computed_at":"2026-11-06T05:58:05Z"},"pay":{"stated_usd_annual":222880,"is_top_pay":true},"html_url":"https://alion.io/job/buffer-lead-security-engineer","json_url":"https://alion.io/job/buffer-lead-security-engineer.json","meta":{"generated_at":"2026-11-07T02:25:52Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5665,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7234},"rest":"https://alion.io/mcp/rest/get_company?id=7234"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbuffer-lead-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbuffer-lead-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbuffer-lead-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/buffer-lead-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbuffer-lead-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3836476}},{"tool":"search_jobs","arguments":{"company":"buffer.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3836476},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}