Navii

Role profile · Engineering

Security Engineer

A type of work, not one opening. Join it from your career profile and you’re matched to Security Engineer roles as they open. No match is guaranteed, and no company sees you until you say yes.

Titles it covers

Application / Product Security. Security Engineer, Application Security Engineer, Software Engineer, Security, Product Security, Privacy Engineer

Infrastructure / Cloud Security. Infrastructure Security Engineer, Cloud Security, Network Security Engineer, Security Platform, DevSecOps Engineer, Security Platform Engineer, Cloud Security Engineer

Detection & Response. Detection Engineer, Incident Response, Threat Detection, Security Operations Engineer

What strong looks like

Has found something real and can say what it was, how they found it, and what changed. Has shipped a control that engineers actually used rather than bypassed. Has been in an incident and can say the first thirty minutes. Thinks in attacker terms and in engineer terms. Knows the difference between a finding and a risk.

Core must-haves

  • Found something real, or shipped a control engineers actually used, and can say what changed
  • Engineering depth: writes production code in Python, Go, or similar; not scanners only
  • Cloud and infrastructure security: identity, secrets, network, Kubernetes
  • Incident handling: has run or been inside an incident and can say the first thirty minutes
  • Risk judgement: decides what is not worth fixing and can defend it
  • Communication with engineering that gets things fixed without escalation

Across every profile: ownership in ambiguity; communication that survives a follow-up; ai-native practice; verifiable outcomes.

Good to have

  • AI-specific security: prompt injection, model abuse, agent permissions
  • Compliance program experience: SOC 2, ISO, FedRAMP, for the platform sub-profile
  • Customer-facing security: reviews, questionnaires, deployments
  • Offensive experience: red team, bug bounty, CTF
  • Privacy engineering
  • Building security tooling for other engineers

Seniority

Open from recent graduates to 15 or more years. We read level from what you have owned, not from years or brand. What the evidence looks like at each stage:

New grad to 2 years. Rare in the market (one posting). A real finding from research, a CTF, or an internship, plus code they wrote. Judged on adversarial reasoning in the live scenario.

2 to 5 years. Owns a security area, has a finding with a story, has shipped one control.

5 to 10 years. Owns a program area, has run an incident, has made a documented risk decision, has moved engineering without escalating.

10 to 15+ years. Sets the security program, owns the bar for a company, has built the function or led it through an audit and an incident.

What to bring

  • Two or three pieces of real work that fit the must-haves: how it came about, what was yours, what was reused, how you did it, what broke and how you fixed it.
  • How you work with AI agents. Where does AI sit in how you do security work today, code review, detection rules, triage, or in what you are defending?
  • What you’re looking for, and your constraints, which stay private.