Staff Security Engineer, Product Security And Architecture

About Compass Compass is a real estate technology company with a powerful end-to-end platform that supports the entire buying and selling workflow. We deliver an incomparable experience to both agents and their clients all in service of the Compass mission: to help everyone find their place in the world. Founded in 2012 by Ori Allon and Robert Reffkin, Compass operates in 22+ regions across the United States including New York, Los Angeles and Orange County, Chicago, San Francisco, Boston, Washington D.C., South Florida, The Hamptons, Santa Barbara & Montecito, San Diego, Seattle & Eastside, Philadelphia, Connecticut, Westchester, Aspen, Boulder, Denver, Atlanta, Austin & Central Texas, Dallas-Fort Worth, Houston, Nashville, and Lake Tahoe. Learn more and find your place at www.compass.com and www.compass.com/careers. Compass only reaches out to applicants from a @compass.com domain and does not prompt applicants to download software or files as part of its application process.

Compass

C

compass.com/careers

1,001-5,000 employees

Real Estate

New York, NY

Public Company

390k LinkedIn followers

Raised $2.6B

• The Security organization protects one of the largest and most complex real
• estate technology estates in the industry. We are hands-on engineers who build
• security as a service: secure-by-design tooling, automated guardrails, and
• trusted partnership with Engineering, rather than gatekeeping. As a Staff
• Security Engineer, you are empowered to directly drive technical security
• results and shaping the roadmaps that our engineering teams adopt and build
• against.
• Automate & Scale Application Security: Build, enhance, and support automated
• application security testing frameworks and tooling to seamlessly integrate
• security into continuous integration and delivery (CI/CD) pipelines.
• Drive Secure-by-Design Architectures: Partner closely with engineering teams
• to evaluate solution architectures and codebases, providing technical
• feedback that embeds secure-by-design principles from the start.
• Serve as a Trusted Security Advisor: Act as a key resource and subject matter
• expert for product and engineering teams, offering security guidance and risk
• evaluations for new product features, development processes, tooling, and
• services.
• Evangelize Product Security: Advocate for secure-by-design approaches across
• the organizations helping to mature the overall security culture.
• Cultivate Collaboration: Build strong, collaborative relationships across the
• Product and Engineering organization to help product teams efficiently
• achieve their delivery goals without compromising on security.
• Secure & Accelerate with AI: Drive the adoption of AI-powered security
• capabilities (e.g., code/IaC scanning copilots and automated triage) to
• foster operational efficiencies, while establishing a AI Security Posture
• Management (AI-SPM) frameworks and secure-by-design standards needed to
• safely integrate AI into CIH products and protect enterprise data assets from
• emerging threats (such as prompt injection, model/data exfiltration, and
• unsanctioned "shadow AI" usage).
• Continuous Innovation: Stay ahead of industry trends, embracing and adopting
• new technologies to ensure security capabilities keep pace with evolving
• business and engineering objectives.

Required

• Strategic Collaborator: You thrive in Agile and DevOps environments, viewing
• security as an enabler of engineering velocity rather than a bottleneck.
• Technical Leader & Advocate: You are passionate about mentoring others and
• can articulately champion security concepts to both deeply technical
• engineers and business stakeholders.
• Analytical Problem Solver: You possess exceptional troubleshooting skills and
• the logical capacity to diagnose complex architectural and pipeline security
• challenges.
• Self-Driven Achiever: You are highly self-motivated, with the organizational
• and time-management skills required to manage multiple complex initiatives
• simultaneously.
• equivalent practical work experience.
• Administering and configuring automated pipeline tools (CI/CD).
• Administering and tuning application security testing tools (e.g., SAST,
• DAST, or SCA).
• Automation scripting using Python or Bash.
• Product development using Python, JavaScript, TypeScript, Golang, or Java.
• Performing security code reviews for solutions built in Python,
• JavaScript, TypeScript, Golang, or Java.
• Participating in security-focused reviews for both vendor and custom
• business solutions.
• Hands-on experience with Infrastructure as Code (IaC) tools (e.g.,
• Terraform) to provision secure, reproducible infrastructure.
• Practical experience working with AWS services, aligning both product
• solution delivery and security objectives.
• Hands-on experience using Artificial Intelligence (AI) to assist with
• product security processes to drive team and operational efficiencies.

Preferred

• Relevant industry certifications (e.g., CEH, CISSP, CSSLP, GIAC, or cloud
• security certifications) are a strong plus.
• Direct experience working within high-performing DevOps and Agile cultures.
• Experience with Layer 7 security controls (e.g., Web Application Firewalls
• (WAF), API Gateways, OAuth2/OIDC implementation, and rate limiting).
• Experience driving secure-by-design practices across multi-cloud strategies
• (e.g., AWS, Azure, GCP).
• Experience reviewing and assessing the use of AI technologies within both
• vendor-provided and custom-developed business solutions.
• Experience operating in a publicly traded company, including familiarity with
• SOX-adjacent control environments and audit processes.
• Experience securing environments through a merger, acquisition, or major
• infrastructure consolidation.
• Compensation: The base pay range for this position is $210,000 - $234,100;
• however, base pay offered may vary depending on job-related knowledge, skills,
• and experience. Bonuses and restricted stock units may be provided as part of
• the compensation package, in addition to a full range of benefits. Base pay is
• based on market location. Minimum wage for the position will always be met

• Participation in our incentive programs (which may include eligible cash,
• equity, or commissions). Plus paid vacation, holidays, sick time, parental
• leave, and recharge leave; medical, tele-health, dental and vision benefits;
• 401(k) plan; flexible spending accounts (FSAs); commuter program; life and
• disability insurance; Maven (a support system for new parents); Carrot
• (fertility benefits); UrbanSitter (caregiver referral network); Employee
• Assistance Program; and pet insurance.
• Do your best work, be your authentic self.
• At Compass, we believe that everyone deserves to find their place in the world —
• a place where they feel like they belong, where they can be their authentic
• selves, where they can thrive.  Our collaborative, energetic culture is grounded
• in our Compass Entrepreneurship Principles and our commitment to diversity,
• equity, inclusion, [https://www.compass.com/diversity-inclusion/] growth and