{"id":3463347,"url":"https://alion.io/job/zipline-seniorstaff-security-engineer-product-security","title":"Senior/Staff Security Engineer - Product Security","company":{"id":15878,"name":"Zipline","domain":"zipline.com","url":"https://alion.io/company/zipline","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":85,"open_postings":15,"ghost_share":0,"stale_share":0.4,"repost_share":0,"time_to_fill_p50_days":63,"computed_at":"2026-11-05T05:54:30Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["South San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":158000,"max_usd":315000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":451},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"Go","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"OWASP","optional":false},{"name":"Python","optional":false},{"name":"Teleoperation","optional":false}],"status":"live","first_seen_at":"2026-08-12T21:03:05Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-11-06T01:17:46Z","board_verified":true,"closed_at":null,"days_open":85,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":85},"description":"About Zipline\nZipline is the world’s largest and most experienced drone delivery service. We are on a mission to serve all humans equally by ensuring access to food, medicine and essential goods anytime, anywhere. We design, build, and operate the world’s largest autonomous logistics system, delivering critical supplies quickly and reliably. Today, Zipline operates on four continents, makes a delivery somewhere in the world every 30 seconds, and has completed millions of deliveries to date, including blood, vaccines, medical supplies, food, and retail products. \nOur customers include the world’s largest and most prominent healthcare systems, governments, retailers, restaurants and global businesses who rely on us to save lives, reduce emissions, increase economic opportunity, and provide delivery from point A to point B as fast as possible. The drone is only 15% of what we’ve built to enable seamless, reliable, global operations.\nOur system strengthens supply chains, reduces congestion, and gives people time back. With more than 140 million commercial autonomous miles safely flown, Zipline is redefining access to healthcare, consumer products, and food across the globe.\nWe operate at a global scale and are looking for practical problem solvers who thrive on real-world challenges and rapid growth. Our team is motivated by building systems that have a direct, meaningful impact on people’s lives and by scaling the future of logistics. We are seeking people who sculpt from first principles, enjoy facing adversity, and can do the impossible at record breaking speeds.\nAbout You and The Role \nProduct security at Zipline protects systems that directly affect safety, regulatory compliance, and uninterrupted delivery of critical goods in real-world operational environments. You will own security for production services and integrations that run our fleet orchestration, distribution center automation, telemetry/teleoperation, and developer/operator toolchains. This role is mission-critical: your work will reduce attack surface that could cause service outages, unsafe drone behavior, data exposure of patient/partner data, or regulatory failure.\nYou will join a small, high-ownership security team and partner deeply with software, infrastructure, autonomy/embedded, and field-ops teams. Expect hands-on engineering work, prioritized ownership of specific services, and a mandate to ship controls that measurably reduce risk in production systems under operational pressure. This is a hybrid onsite role: you will be at our South San Francisco HQ frequently and must be available for occasional travel to distribution centers and test sites.\nWhat You'll Do\nOwn security outcomes for 2-4 named production areas (examples: fleet orchestration APIs, DC orchestration/robotics control plane, telemetry and command channels, developer CI/CD and secrets platforms). Be the primary security owner for at least one area on hire.\nDeliver measurable risk reduction: define baseline metrics (e.g., mean-time-to-detect, mean-time-to-remediate, number of exploitable findings) and be accountable to improving them by defined targets in 6 and 12 months (example targets: cut exploitable high-risk findings by 50% in owned services; reduce MTTD for critical alerts to <30m).\nDesign and implement production controls: IAM/least-privilege policies, service-to-service trust, key lifecycle and KMS integrations, runtime telemetry and alerting, secure OTA/update patterns for edge devices, and hardened CI/CD pipelines and build artifact provenance.\nThreat model and perform secure design reviews for services that operate near the physical fleet, regulated workflows, or partner/customer interfaces; produce engineering-tractable mitigations and drive their rollout to completion.\nLead vulnerability management end-to-end for owned services: vulnerability triage with exploitability analysis, prioritized remediation plans with engineering partners, staged verification, and verification metrics for closure and regression prevention.\nBuild and harden incident response for product incidents: author playbooks, run tabletop exercises with product and operations, validate logging/auditability so incidents are forensic-ready, and participate in incident postmortems with corrective action tracking.\nSecure AI/agent-assisted development and ops: define allowed copilots and patterns, implement guardrails to prevent secret exposure and unauthorized actions, and add monitoring/auditing for risky agent behaviors where it intersects owned systems.\nIntegrate external pentest and red-team results into durable engineering changes; turn test findings into tracked engineering tickets and measurable closure criteria.\nCollaborate daily with SREs, platform engineers, autonomy/embedded teams, field ops, and compliance to translate regulatory/safety requirements (e.g., health-adjacent data handling, auditability) into concrete technical controls.\nWhat You'll Bring\nHard requirements (must-haves):\n8+ years building and operating security controls for large-scale production systems across application and cloud infrastructure.\nDemonstrable hands-on engineering ability: you ship automation or tooling in Python, Go, or similar and can build integrations with AI tools and agentic security bots (not only write policies).\nDeep practical experience with cloud-native stacks and microservices (Kubernetes, containers, IAM, CI/CD, secrets management, logging/telemetry) and with designing least-privilege service-to-service models.\nPrior ownership of vulnerability management, incident response playbooks, and verification processes for production services.\nDirect experience threat-modeling and securing systems that interface with physical systems, regulated workflows, or third-party partners (embedded, teleoperation, field ops, or healthcare-adjacent data flows).\nAbility to define and track quantitative success metrics (MTTD, MTTR, number of exploitable findings, compliance audit readiness) and be accountable for meeting targets within 6-12 months.\nNon-negotiable traits:\nOperates as a technical owner: can persuade engineering teams, prioritize trade-offs, and drive changes through to production without relying solely on policy enforcement.\nSkeptical, adversarial mindset: anticipates failure modes and abuse cases for systems that interact with the physical fleet and partner workflows.\nAdditional strong qualifications (if present):\nExperience securing LLM/agentic tools in engineering workflows and mitigating OWASP LLM risks (prompt injection, unsafe plugin/output handling, agentic privilege misuse).\nBackground across multiple domains (cloud infra, web services, and embedded/autonomy) and experience building developer-friendly security platforms or paved-road tooling.\nWhat Else You Need To Know \nThis is a hybrid role based in South San Francisco; frequent HQ presence required and occasional travel to field sites. This role has production ownership and will participate in incident response; candidates must be prepared for on-call participation when assigned.\nZipline is an equal opportunity employer and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws or our own sensibilities.\nWe value diversity at Zipline and welcome applications from those who are traditionally underrepresented in tech. If you like the sound of this position but are not sure if you are the perfect fit, please apply!\nVoluntary Self-Identification\nFor government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.\nAs set forth in Zipline ’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.","description_format":"text","description_chars":8177,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Drones & UAVs","Delivery","Logistics"],"lifecycle":[{"event":"open","at":"2026-10-29T14:36:18Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 63 · green card filings: 13","filings_12m":63,"filings_prev_12m":47,"green_card_filings_12m":13,"median_offered_wage_usd":170658,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":35,"band":"fade","label":"Fading","p_open":1,"p_active":0.801,"p_room":0.44,"age_days":84,"expected_fill_days":63,"reasons":["conf:0","velocity","win:tail","crowd:brand"],"computed_at":"2026-11-05T05:54:30Z"},"pay":null,"html_url":"https://alion.io/job/zipline-seniorstaff-security-engineer-product-security","json_url":"https://alion.io/job/zipline-seniorstaff-security-engineer-product-security.json","meta":{"generated_at":"2026-11-06T04:55:18Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8509,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":15878},"rest":"https://alion.io/mcp/rest/get_company?id=15878"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fzipline-seniorstaff-security-engineer-product-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fzipline-seniorstaff-security-engineer-product-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fzipline-seniorstaff-security-engineer-product-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/zipline-seniorstaff-security-engineer-product-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fzipline-seniorstaff-security-engineer-product-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3463347}},{"tool":"search_jobs","arguments":{"company":"zipline.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3463347},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}