Senior Security Engineer

Paragon is an embedded integration infrastructure platform for B2B SaaS and AI products. Engineering teams use Paragon to build native, user-facing product integrations that connect their apps to their customers’ third-party tools (like Salesforce, Slack, Google Drive, and hundreds more) without having to manage auth, rate limits, or custom integration plumbing themselves.

Our platform provides the building blocks for every integration
-130+ native connectors plus a custom integration builder, a fully embeddable Connect Portal SDK, multi-tenant architecture, and flexible deployment options including cloud and on-prem. Teams can orchestrate complex workflows and automations using our suite of products:

Managed Syncfor fully managed data ingestion,Action Kitas a universal API for real-time actions, and Workflows for event-driven automations and integration logic.

We’re trusted by hundreds of SaaS companies to help them ship every integration their customers need with a fraction of the engineering effort.

About The Role

We’re hiring our first dedicated security hire to own security end-to-end across our product, infrastructure, and organization. You’ll be both a hands-on security engineer and the security lead who sets direction, defines standards, and builds the foundation of our security program.

You’ll partner closely with engineering, product, and GTM teams to keep our platform and customer data safe, while also unblocking enterprise deals and strengthening our security posture as we scale.

If you enjoy building security programs from (almost) scratch, influencing without heavy process, and still getting deep into the technical details, this role is for you.

What You'll Own

• Company-wide security posture across application, infrastructure, and internal systems
• Secure SDLC: how we design, build, test, and release secure software
• Cloud & infrastructure security in our AWS, GCP, and Azure environments
• Vulnerability management: from discovery to prioritization and remediation
• Security governance & compliance, including SOC 2, HIPAA, and customer requirements
• Incident readiness & response, including playbooks, tooling, and training
• Security story for customers: helping sales and customer success win and retain larger customers

What You'll Do

Product & application security

• Partner with engineering and product todesign secure architectures and features.
• Introduce and maintain asecure SDLC: threat modeling, design reviews, secure coding guidelines.
• Implement and manage tooling such asSAST/DAST, dependency and container scanning integrated into CI/CD.
• Triage and prioritize vulnerabilities; drive remediation with engineering teams.

Cloud & infrastructure security

• Harden ourcloud environment(e.g., AWS IAM, VPCs, security groups, KMS, secrets management).
• Define and enforce secure-by-default baselines using infrastructure-as-code (e.g., Terraform).
• Establish logging, monitoring, and alerting for key security events.
• Collaborate with platform/infra engineers to build guardrails instead of gates.

Governance, risk, and compliance

• Own and evolve core security policies(access control, change management, incident response, vendor management, etc.).
• Lead ourSOC 2program (and future frameworks as needed): mapping controls, evidence, and audits.
• Define and maintain incident response plans, runbooks, and playbooks.
• Lead incident investigations when they occur and coordinate cross-functional response.
• Run tabletop exercises and post-incident reviews; ensure learnings translate into durable improvements.

Security culture & customer trust

• Provide training and enablementfor engineers and staff on secure practices.
• Be the security point of contact for customer questionnaires, RFPs, and enterprise security reviews.
• Help sales and customer success articulate our security posture clearly and credibly.

What Success Looks like in 6 - 12 months

• We have a clear view of ourcrown jewels, data flows, and key risks, documented and understood.
• Corecloud and application security baselines are in place and enforced via code.
• Thesecure SDLCis embedded into our development process with practical, lightweight checks.
• We have astructured vulnerability management process with agreed SLAs and…