Director of Security Engineering

What you will do

You'll own security engineering across four pillars — product security, production security, offensive security, and assurance engineering — and you'll build two programs from nothing: agentic continuous pentesting integrated with specialized human testing, and a security champions program covering both classical and AI security.

This role is Sysdig's customer zero, and we mean that operationally rather than rhetorically. You'll run our security program on our own technology, starting with the headless expression of Sysdig Secure and the products we're building to protect AI workloads. You'll sit with the product team on roadmap direction, with as much influence as you're willing to take.

The Office of the CISO operates transparently, and we want our security team publishing and speaking, so the work you do here becomes work the industry can use — with a real production environment to cite and a product you helped design as the evidence.

• Own security engineering end-to-end. Set the roadmap, standards, and budget for the function. Act as final decision-maker on tooling and practice.
• Build and grow the team. Hire senior and staff security engineers, set their technical direction, and stay close enough to the code to be credible with the engineers you're asking to change how they work.
• Own product and platform security. Threat model the cloud defense platform and our AI workload protection products. Build secure-by-default primitives engineers build on rather than around. Drive vulnerability management measured by closure, not ticket volume.
• Harden production as code. Secrets and workload identity, Kubernetes and multi-cloud hardening delivered through Terraform and CI/CD rather than documentation. Run detection and response in our own environment, on our own telemetry.
• Build agentic continuous pentesting with humans in the loop where humans are better — agent-driven adversarial validation integrated with specialized human pentesting through our partner network. You define where agents are trusted, where they aren't, and how findings feed detection coverage.
• Own attack enumeration, detection coverage, and validation as measured disciplines rather than as an annual engagement ending in a PDF.
• Rebuild how compliance works here. We maintain ISO 27001, ISO 27701, and SOC 2 Type II, and we're moving entirely off point-in-time assessments. Build continuous assurance: controls that report their own state, evidence generated as a pipeline output, validation running continuously against production.
• Make AI-assisted development safe at our scale. Define what coding agents can touch, what they can commit, and how you'd know if one were subverted by an insider, an external actor, or another agent.
• Use agents to scale the security function itself — triage, control validation, evidence generation, detection authoring. If a security task is repeatable, it should run without the team.
• Build the security champions program across both classical security, and AI security, As a means of scaling and increasing velocity of security across the engineering organization.
• Shape the product roadmap as customer zero. Use new capabilities in production before customers do, then work directly with product on what to build, shape, or stop.
• Represent security externally. Engage major customers on matters of significance, and publish and speak on the work — encouraged, resourced, and supported.

What you will bring with you

• Have 8+ years in security or software engineering, including 4+ years leading and developing engineers, with real ownership of a team's roadmap, outcomes, and budget
• Have genuine depth in at least two of the four pillars, with working knowledge of all four — we'd rather have real expertise in product and offensive security than a survey of everything
• Have shipped security as code: Terraform or OpenTofu, controls enforced in pipelines, cloud and Kubernetes security at the architectural level rather than the dashboard level
• Have run detection and response for real, as the person on the escalation path rather than above it
• Are already building with agentic tooling and have opinions about where it fails
• Would rather make the secure path the easiest path than enforce it through policy — most of the impact here comes through partnership with Engineering and Product, not mandate
• Are credible with a customer's CISO and with your own engineers, without changing register much between them
• Are energized rather than unsettled by problems where established principles don't fully apply

What we look for

• Built a security function that didn't exist before, at a company where much of it was theirs to define
• Experience with capable adversaries — APT actors or other sophisticated cyberoffensive groups
• Built or run agent-driven offensive tooling, or automated vulnerability discovery and remediation at scale
• Worked on AI governance frameworks — ISO 42001, the EU AI Act, NIST AI RMF — as an engineering problem rather than a documentation exercise
• A track record of conference speaking, published research, or open-source contribution

When you join Sysdig, you can expect