Staff Security Engineer (DevSecOps)

About this role

ABOUT COMPA

Compa is a venture-backed AI startup revolutionizing the future of compensation! We're bringing AI-forward tools and human-centered engineering to make pay competitive and fair, for all. By offering a premier, live compensation data platform that delivers top-tier intelligence to enterprise teams, we enable the world's largest companies to make smart and fair decisions while staying competitive and compliant. In dynamic job markets during the rise of AI, companies need the best data to stay competitive!

Our force-multiplying team is powered by live data and thoughtful design, and our products have earned the trust of the world’s largest companies: NVIDIA, Stripe, DoorDash, OpenAI, Moderna, Workday, Ulta, Target, and more.

Come build with us!

THE ROLE

We're looking for a Staff Security Engineer to own DevSecOps at Compa, reporting directly to the Head of Security. This role has enterprise scope, and operates at the intersection of software engineering security operations - hands-on, in the code, partnering daily with Product, Platform, Engineering, and Security. You'll own threat modeling and feature risk assessment end to end, designing alongside Product and Engineering and staying with it through ship, making sure guardrails scale alongside the business and engineers are enabled each step of the way.

WHAT YOU’LL DO

Build Security Tooling, and Ship It

- Build and ship internal security tooling, automation, and guardrails.

- Implement secure-by-default patterns, libraries, and paved paths that strengthen posture while reducing developer friction.

- Prototype and deliver production-ready implementations for security initiatives.

Own Threat Modeling

- Lead security design reviews for new features, third-party integrations, and emerging technologies.

- Build and own threat detection across applications, APIs, cloud infrastructure, and data pipelines.

Secure the Pipeline and Infrastructure

- Embed security into CI/CD, such as container security scanning, dependency and image analysis, SAST/DAST, and automated checks in the release process, defining end-to-end security controls for code as built, shipped, and deployed.

- Partner on cloud security posture, infrastructure hardening, secrets management, workload identity, and security observability.

- Contribute to incident response, investigations, and remediation when needed.

Level Up Engineers

- Train engineers and operationalize security practices the team that drives security-first engineering culture. Turning one-off fixes into repeatable, self-serve patterns.

Advance AI Security

- Secure AI-native and AI-assisted development workflows, and translate emerging AI risks into practical engineering controls.

- Serve as the security subject matter expert for Compa’s AI-powered products and features across the product lifecycle.

WHAT WE’RE LOOKING FOR

- Senior or Staff level experience blending software engineering and security operations. Experience writing production code, not just reviewing it.

- Hands-on DevSecOps background: CI/CD security, container security scanning, cloud/infra hardening, secrets management.

- Successful ownership and improvement of threat modeling and risk assessment end to end, from design through production.

- Experience building and operationalizing security tooling that engineers actually adopt

- Hands-on AI work (professionally or on your own) across both AI-native development and AI as a product.

AS A PLUS

- Experience securing cloud-native infrastructure in AWS environments.

- Experience designing or implementing enterprise-facing capabilities such as SAML, SCIM, RBAC, audit logging, or customer-facing security controls.

- Experience building, operating, or securing AI-enabled products, agents, MCP servers, or retrieval systems.

- Experience building or scaling a Product Security or Security Engineering function in a high-growth technology company.

Compa offers a competitive and comprehensive benefits package including medical, dental, vision, PTO and parental leave, equity, company offsites, continuous education, commuter benefits and a flexible work environment.

Similar jobs

• Staff Security Engineer - SecOps & Threats — 6sense · Remote
• Staff Security Engineer — Fanduel · New York City
• Staff Security Engineer — Fanduel · Atlanta, Georgia, United States
• Staff Security Engineer — Assured · Remote
• Staff Security Engineer — Socket · Remote
• Staff Security Engineer — Livekit · Remote
• Staff Security Engineer — Addepar1 · New York, NY
• Staff Security Engineer — Smarterdx · Remote