资深企业安全工程师
Staff Corporate Security Engineer
为什么选择Harvey
在Harvey，我们正在改变法律和专业服务的运作方式。通过结合前沿的代理AI、企业级平台和深厚的专业知识，我们正在重塑未来数十年的关键知识工作方式。
这是一个难得的机会，帮助打造一家具有时代意义的公司，在真正的转折点上共同前进。我们拥有强大的产品市场匹配度和世界级的投资支持。我们正在快速扩展，并实时定义一个全新的领域。这项工作充满雄心，标准很高，个人、职业和财务上的成长机会是无与伦比的。
我们的团队行动迅速，有主人翁意识，并对使命充满热情——以高强度的方式运作，贴近客户，不断追求卓越。我们秉持三个价值观：果断、简洁和工作未完成。我们在清晰判断的基础上快速行动，而非等待完美信息；我们相信简洁才是可扩展的关键；我们从不满足于现状。如果你希望与志同道合、同样充满激情的人一起完成职业生涯中最出色的工作，我们期待与你携手共进。
在Harvey，专业服务的未来正在今天被书写——而我们才刚刚开始。
职位概述
一些全球最大的公司及其律师事务所使用Harvey的AI来以前所未有的规模提供世界级的客户服务，并在此过程中将最敏感的文件交由Harvey处理。
这个职位将加入Harvey的企业安全职能，随着Harvey的快速发展，负责保护公司的IT和业务系统，在风险与用户体验之间取得平衡，通过威胁建模和实际测试验证每个假设，而不是仅仅依赖最佳实践。
这适合一位处于安全工程和企业系统交叉领域的专业人士——了解数据如何在SaaS应用之间流动，能够识别复杂集成中的安全漏洞，并知道如何构建可扩展的控制措施。由于Harvey的客户群体性质，具备eDiscovery流程和法律保留经验是一个重要的优势。
你将负责
- 企业集成与SaaS安全：设计、实施并管理跨应用的数据流、API集成、OAuth连接和第三方SaaS平台的安全控制。负责新集成的安全评审生命周期，并通过自动化姿态监控尽早发现偏差。
- eDiscovery与法律保留计划：持续优化eDiscovery流程，确保法律保留机制有效运行，保障客户数据的合规性和安全性。
查看英文原文
WHY HARVEY
At Harvey, we’re transforming how legal and professional services operate. By combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise, we’re reshaping how critical knowledge work gets done for decades to come.
This is a rare chance to help build a generational company at a true inflection point. We have strong product-market fit and world-class investor support. We’re scaling fast and defining a new category in real time. The work is ambitious, the bar is high, and the opportunity for growth — personal, professional, and financial — is unmatched.
Our team moves fast, takes ownership, and is deeply committed to the mission — operating with intensity, staying close to our customers, and pushing each other for excellence. We live by three values: Decisiveness, Simplicity, and Job's Not Finished. We act quickly on clear judgment over perfect information, we believe simplicity is what scales, and we're never satisfied with where we are. If you want to do the best work of your career alongside people who share that drive, we'd love to build with you.
At Harvey, the future of professional services is being written today — and we’re just getting started.
ROLE OVERVIEW
Some of the world's largest companies and their law firms use Harvey's AI to deliver world-class client services at unprecedented scale, entrusting Harvey with their most sensitive documents in the process.
This role joins Harvey's corporate security function, which secures the company's IT and business systems as Harvey grows rapidly, balancing risk with user experience while validating every assumption through threat modeling and real-world testing rather than relying on best practice alone.
It is a strong fit for someone at the intersection of security engineering and enterprise systems- someone who understands how data flows between SaaS applications, can pinpoint where security breaks down in complex integrations, and knows how to build controls that scale. Experience with eDiscovery workflows and legal holds is a meaningful differentiator given the nature of Harvey's customer base.
WHAT YOU'LL DO
- Enterprise Integrations & SaaS Security: Design, implement, and govern security controls for cross-application data flows, API integrations, OAuth connections, and third-party SaaS platforms. Own the security review lifecycle for new integrations and automate posture monitoring to catch drift early.
- eDiscovery & Legal Hold Program: Continue to build and operate Harvey's legal hold infrastructure, including data preservation, collection workflows, and custodian management. Partner with Legal and Compliance to meet litigation readiness requirements across our collaboration and productivity stack.
- IT & Business Systems Partnership: Provide security oversight across the SaaS application lifecycle — vendor onboarding assessments, ongoing configuration review, and decommissioning.
- Endpoint Security: Support endpoint security policies and vulnerability management, ensuring endpoint telemetry feeds into detection and response workflows.
- Security Detection & Response: Develop scripts and integrations that extend visibility across corporate systems, partnering with the Detection & Response team to surface signals from SaaS and business applications.
WHAT YOU HAVE
- Demonstrated experience securing enterprise SaaS environments, including integration security, API token management, OAuth governance, and cross-application data flow risk — with working knowledge of authentication/authorization standards (SAML, OIDC, SCIM, X.509) and the ability to debug real-world integration failures.
- Experience building or managing eDiscovery and legal hold programs, including data preservation workflows, custodian management, and coordination with Legal and outside counsel. Familiarity with tools such as Purview, Vault, Relativity, Everlaw, or similar platforms is a plus.
- Strong software engineering fundamentals with proficiency in Python and/or Go, including building integrations against SaaS APIs (not just configuring through consoles), and experience with infrastructure-as-code tooling such as Terraform and/or Pulumi for managing security configurations in a repeatable, auditable way.
- Ability to identify risks and vulnerabilities in IT and business systems and communicate that risk clearly to stakeholders across engineering, legal, and executive audiences.
- Familiarity with endpoint security for macOS and Windows environments, and experience with tools such as Okta, Google Workspace, Salesforce, Workday, NetSuite, Microsoft Entra/Azure/Intune, JAMF, Tines, or similar platforms.
- 4+ years of experience in security engineering, corporate engineering, IT, or a related program management function with a security focus. Experience with generative AI or the legal industry is not required — but genuine curiosity about both will serve you well here.
COMPENSATION
$220,000 - $330,000 USD
DEPENDING ON YOUR LOCATION, AN APPLICANT PRIVACY NOTICE MAY APPLY TO YOU. YOU CAN FIND ALL OF OUR APPLICANT PRIVACY NOTICES HERE https://harveyai.notion.site/Harvey-Candidate-Privacy-Notices-319ac3fcdd7a803bb807d5094f249922?pvs=74.
#LI-AH1
Harvey is an equal opportunity employer and does not discriminate on the basis of race, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law.
We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made by emailing accommodations@harvey.ai