资深安全工程师
Staff Security Engineer
Assured致力于革新保险行业。理赔处理（即我们是否应该支付这笔索赔？）虽然常常被忽视，却是整个行业的基础。目前这一过程高度依赖人工，涉及电话、传真和直觉判断，每年耗费数十亿美元。我们可以做得更好。
在Assured，我们为大型保险公司提供软件解决方案，帮助他们在技术驱动的现代世界中取得成功。从自助理赔软件到后端欺诈检测，我们是为全球最大保险公司之一提供理赔处理支持的核心引擎。
我们面临的挑战深刻而多样，从为最紧张和脆弱的索赔人创建提供舒适和清晰体验的数字化服务，到协调大规模机器学习驱动的数以十亿美元计的理赔决策，Assured的工作充满活力、协作与成就感。
我们正在寻找一名**资深安全工程师**，帮助我们在平台、基础设施和开发流程中扩展和提升安全性。该职位将与工程、基础设施和产品团队紧密合作，将安全性嵌入我们的软件构建和运营方式中。
你将结合深厚的技术专长与战略思维——识别风险，设计可扩展的安全解决方案，并建立能够提升安全态势和工程效率的项目。
**你将负责…**
🛡️ 在应用程序、基础设施和集成中领导安全架构和设计评审，确保安全模式在开发生命周期早期就被嵌入。
🔎 进行并协调渗透测试、威胁建模和安全评审，针对关键服务、新功能和第三方集成。
⚙️ 在CI/CD流水线中设计和实现安全自动化，确保在大规模上执行安全编码实践和基础设施策略。
☁️ 与基础设施和DevOps团队合作，保护云平台（AWS），并提升身份、网络和工作负载的安全性。
📊 构建安全可观测性和检测能力，包括安全数据管道、SIEM集成和威胁情报信号。
🧠 以攻击者思维思考——识别系统性弱点，并设计能抵御整个攻击类别的控制措施，而不仅仅是单个漏洞。
🧑💻 与开发人员密切合作，通过安全架构指导、代码审查支持和开发者赋能来提升安全实践。
🚨
查看英文原文
Assured is on a mission to modernize insurance. Claims processing (i.e. should we pay this claim?), while often overlooked, is the foundation of the entire industry. It’s currently highly manual, involving phone calls, faxes, and gut instinct, costing tens of billions of dollars a year. We can do better.
At Assured, we provide large insurers with the software solutions they need to win in a modern, technology-driven world. From self-service claim-filing software to backend fraud detection, we’re the engine that powers claims processing for some of the largest insurers in the world.
The challenges we face are deep and diverse, from creating digital experiences that provide comfort and clarity to claimants at their most stressed and vulnerable to orchestrating large-scale ML-driven decision-making on billions of dollars of claims payments, life at Assured is dynamic, collaborative, and rewarding.
We’re looking for a **Staff Security Engineer** to help scale and mature security across our platform, infrastructure, and development workflows. This role will partner closely with engineering, infrastructure, and product teams to embed security into how we build and operate software.
You’ll combine deep technical expertise with strategic thinking—identifying risk, designing scalable security solutions, and building programs that improve both security posture and engineering efficiency.
**You Will…**
🛡️ Lead security architecture and design reviews across applications, infrastructure, and integrations to ensure secure patterns are embedded early in the development lifecycle.
🔎 Conduct and coordinate penetration testing, threat modeling, and security reviews for critical services, new features, and third-party integrations.
⚙️ Design and implement security automation within CI/CD pipelines to ensure secure coding practices and infrastructure policies are enforced at scale.
☁️ Partner with infrastructure and DevOps teams to secure cloud platforms (AWS) and improve identity, network, and workload security.
📊 Build security observability and detection capabilities, including security data pipelines, SIEM integrations, and threat intelligence signals.
🧠 Think like an attacker—identify systemic weaknesses and design controls that protect against entire classes of attacks, not just individual vulnerabilities.
🧑💻 Work closely with developers to improve security practices through secure architecture guidance, code review support, and developer enablement.
🚨 Lead incident response investigations and help build processes for identifying, analyzing, and mitigating security incidents.
🐞 Own and evolve the bug bounty program, including triage, response processes, and improvements to vulnerability management workflows.
📚 Develop security standards, playbooks, and training programs that make security practices easier for engineering teams to adopt.
📈 Help define the security roadmap, identifying initiatives that improve both risk posture and operational efficiency.
### **You Have…**
🔐 Deep understanding of application security, cloud security, and modern threat landscapes, including common vulnerabilities and attack techniques (OWASP Top 10, MITRE ATT&CK, etc.).
💻 Strong software engineering background with experience writing production-grade code or automation (Python, Typescript, or similar).
☁️ Hands-on experience securing cloud-native infrastructure, especially AWS, including IAM, networking, and containerized workloads.
⚙️ Experience building or integrating DevSecOps pipelines, including SAST, DAST, IaC scanning, and container security tooling.
📊 Experience designing security telemetry pipelines using tools such as SIEM platforms, observability systems, or data lakes.
🧪 Experience running or participating in penetration testing, threat modeling, or architectural security reviews.
🤝 Proven ability to collaborate effectively with engineering, DevOps, and product teams to drive secure design decisions.
📢 Excellent communication skills and the ability to clearly explain complex security risks and trade-offs to both technical and non-technical stakeholders.
📡 Strong understanding of SaaS architectures, distributed systems, and internet-facing platforms.
🧱 Experience developing security frameworks aligned with CIS benchmarks, NIST, or SOC2 / PCI / HIPAA compliance requirements.
🧠 Experience building security detections, threat intelligence pipelines, or runtime protection mechanisms.
🐳 Hands-on experience with Kubernetes, container security, and infrastructure-as-code (Terraform, Ansible).
**Benefits:**
🤑 Competitive Compensation: Competitive salary and equity packages for all employees
🏥 Healthcare Plan: Platinum medical, dental, and vision
🛡️ Free life insurance: Including long-term disability & short-term disability
🏄 Unlimited PTO: Uncapped vacation days & paid holidays
👶 Family Leave: Maternity & paternity
📈 401(k) Contribution: Assured contributes 3% of your income, even if you don't contribute
🏠 WFH Benefits: Lunch on us 2x/week, monthly phone stipend & other home office perks
👪 Health FSAs & HSAs: Pre-tax accounts for out-of-pocket medical expenses
🤝 Team events & Offsites: We're remote, but we regularly get together
****We have been made aware of individuals falsely posing as recruiters from Assured Insurance Technologies Inc. Please note that we only contact candidates from official @** [**assured.claims**](http://assured.claims) **email addresses and all interviews are conducted through verified company channels. If you are unsure whether a message is legitimate, please contact us directly at recruiting-ops@assured.claims before sharing any personal information****
**Our Commitment:**
_We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, sex, gender, gender expression, sexual orientation, age, marital status, veteran status, or disability status. We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, perform essential job functions, and receive other benefits and privileges of employment. Please contact us to request accommodation._