Senior Security Engineer - Threat Modeling

Overview

Who we are

Samsara (NYSE: IOT) is the pioneer of the Connected Operations™ Cloud, a platform that enables organizations that depend on physical operations to harness Internet of Things (IoT) data to develop actionable insights and improve their operations. Samsara aims to improve safety, efficiency and sustainability of physical operations that power the global economy across industries such as agriculture, construction, field services, transportation, and manufacturing.

Working at Samsara means you’ll help define the future of physical operations on a team shaping product solutions including Video-Based Safety, Vehicle Telematics, Apps and Driver Workflows, and Equipment Monitoring. As a recently public company, you’ll have autonomy and support to make an impact as we build for the long term.

We’re seeking a talented Senior Security Engineer with hands-on experience deploying, managing, leading and performing threat models. In this role, you’ll work with technical product managers and engineers across the company to maintain Samsara’s security and de-risk software security concerns to better protect our customers.

We seek someone who is passionate about leveraging automation to enhance efficiency, is enthusiastic about infrastructure-as-code, and has experience collaborating with teams to reduce software vulnerabilities. Your contributions will be critical to shaping our overall security and compliance strategy. We value working backwards from winning as an operating principle; your ability to define success and work with cross-functional stakeholders is pivotal.

This is a remote position open to candidates residing in the US except the San Francisco Bay Metro Area, NYC Metro Area, and Washington, D.C. Metro Area. You will regularly work with UK and India team members via Zoom during United States standard working hours.

• You want to impact the industries that run our world: Your efforts will have real-world impact—helping to keep the lights on, get food into grocery stores, reduce emissions, and ensure workers return home safely.
• You are the architect of your own career: This role offers opportunities for growth and development in a hyper-growth environment.
• You’re energized by our opportunity: The vision to digitize large sectors of the global economy requires your best efforts and creative ideas.
• You want to be with the best: You will be surrounded by a high-caliber team that supports your success.

• Lead and own ongoing operation and maintenance of Samsara’s threat modeling program, ensuring consistent execution of processes.
• Assist in detecting and raising risks within the Samsara ecosystem, and recommend next steps balancing business needs.
• Collaborate with the Vulnerability Technical Program Manager to generate and distribute monthly and quarterly compliance reports.
• Work with engineering teams to track and support remediation of identified vulnerabilities, providing guidance on best practices.
• Participate in security incident investigations related to high-profile vulnerabilities, gathering data and assessing potential impact on Samsara infrastructure.
• Contribute to documentation and process improvements to streamline risk management workflows.
• Champion Samsara’s cultural principles in daily work:
  Focus on Customer Success, Build for the Long Term, Adopt a Growth Mindset, Be Inclusive, Win as a Team.
• Be regularly on call to support.

• 6+ years of relevant experience with demonstrated impact in application or product security and threat modeling in an enterprise environment.
• Deep familiarity with OWASP Top Ten, the STRIDE threat modeling framework (or equivalents like PASTA or DREAD), and MITRE ATT&CK.
• Experience defining and driving SDLC adoption with business-focused engineers.
• Experience managing Bug Bounty programs such as Bugcrowd.
• Strong familiarity with common security vulnerabilities and ability to judge their severity and impact on the business.
• Experience coding with Python or GoLang.

• Security certifications such as CISSP, AWS Certified Security Specialty, or equivalent.
• Knowledge…