Senior Engineer (Security Engineering)

Join VTS, a leading technology platform for commercial real estate. As a Senior Engineer in Security Engineering, you will play a crucial role in strengthening our security processes and posture. You will own and engineer our detection, investigation, and response capabilities, ensuring our software supply chain, cloud infrastructure, and applications are resilient by design. You will also lead vulnerability management and threat modeling, partner with legal and IT to maintain compliance, and mentor engineers on secure coding and security-first development.

About VTS

A Student of the Craft: You're less interested in being the smartest person in the room than in staying honest about how fast the room is changing. AI has rewritten the security landscape almost overnight, and some of the assumptions and playbooks that worked two years ago no longer hold. You know your way around Arxiv and ACM, and keep a genuine eye on the research as it's published, not just the vendor’s take on it three months later. You track where the industry is headed, not just where it's been, and you're comfortable saying "that doesn't work anymore" and rebuilding the approach

Responsibilities

• Définir et mettre en œuvre des processus de sécurité pour identifier et corriger les vulnérabilités avant qu'elles ne soient exploitées.
• Posséder et gérer les capacités de détection, d'investigation et de réponse aux incidents de sécurité, en intégrant l'IA pour améliorer la défense.
• Diriger la gestion des vulnérabilités et la modélisation des menaces dans l'ensemble de l'environnement, en priorisant en fonction de l'exploitabilité réelle.
• The "AI Native" Defender Mindset: You are passionate about the intersection of security and AI, and you think beyond CVE feeds, you want LLM inference embedded at multiple layers of the platform (supply chain, code, runtime) doing the correlation and triage a human can't keep pace with alone. To you, an LLM is nothing more than a non-deterministic program, and you can tell the difference between a genuine threat and hype

Requirements

• Foundational & Polyglot: You can write in a systems-level language, such as C, C++, Rust, Go, or ASM, not because you'll ship production code daily, but because writing it is what makes reading it, and anything else in the stack (Ruby, Node.js, Java, Typescript, Python), critically possible. If the moment ever calls for it, you can pop open a shared object in a disassembler and figure out what is actually happening
• Autonomous Operator: You take direction from your team lead on priorities, but how you plan and execute against those priorities, and how you go about securing the environment day to day, is up to you. If you spot a gap, something that needs doing and isn't on the agenda, you don't wait for it to be assigned, you raise it and work with your lead to get it prioritized
• Secure by Design: You have hands-on experience with secrets management (Vault, AWS KMS/Secrets Manager, or similar), secure API design (authN/authZ, input validation, rate limiting), and system hardening standards like CIS Benchmarks and SELinux/AppArmor
• Investigator's Mindset: You are a relentless, curious investigator who follows a problem from initial exposure to root cause to full closure, paired with a genuine hunger to learn that keeps you ahead of new attack techniques and defensive tooling. You respond in measured steps, not everything is a crisis, and you understand that "don't panic" is a discipline, not just a slogan
• Proven Track Record: You have 8+ years of experience in Security Engineering, AppSec, Vulnerability Research, or Incident Response, with at least 2 years in a Senior-level capacity driving cross-team initiatives
• Compliance Fluency: You're comfortable operating within SOC 2, ISO 27001, or similar compliance frameworks, and know how to satisfy an audit's control requirements without over-engineering the underlying system

Pay

USD 160,000 - 200,000