SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 220,000 - 240,000 / annual
Material Security protects Google Workspace for sophisticated security teams. As Senior Corporate Security Engineer, you will own and mature Material's own corporate security program, serving as customer zero for the company's product while building detection and response capabilities powered by LLM-driven tooling.
You will own corporate telemetry and detection content end-to-end, closing coverage gaps and reducing noise with measured fidelity. Key focus areas include account takeover, session token theft, malicious OAuth grants, admin abuse, and exfiltration by legitimate users. You will lead corporate incident response and own playbooks.
You will design and build an LLM-driven triage agent that reviews privileged access grants, customer data access, and high-fidelity alerts in near real time, with labeled evaluation sets, measured precision/recall, explicit limits on automated action, and defenses against prompt injection or social engineering via logs.
You will share responsibility with the CorpSec team on endpoint security (Mac fleet device management, EDR, update enforcement, browser-level DLP, BYOD posture), identity and SaaS (IdP, phishing-resistant auth, SSO gaps, access-review automation, vendor/OAuth review pipelines), and Google Workspace (admin alerting, OAuth/Apps Script governance, sharing, DLP). You will also collaborate with AppSec on the corporate-to-production boundary, including cross-boundary detections and just-in-time access.
Material is remote-first with an office in San Francisco. The environment is modern and mature for a startup: Mac-only fleet, Google Workspace, SIEM, IdP, EDR, fleet management, and cloud production infrastructure.
REQUIREMENTS:
- 6+ years hands-on corporate or enterprise security, detection and response, with direct ownership of SIEM, detection content, and incident response
- Proficiency in Python, Go, or TypeScript working directly against vendor APIs; you automate enforcement rather than configure by hand
- Deep understanding of OAuth, SAML/OIDC, session and token lifecycle, and identity-to-cloud-IAM flows
- Experience managing a Mac fleet with modern MDM and EDR, taking it from deployed to enforced
- Hands-on experience building or seriously experimenting with LLM-driven workflows (prompting, tool use, evaluation) and ability to measure effectiveness
- Nice to have: contributed detection logic or security features to a product codebase and comfortable in engineering team review/release processes
- Collaborative, curious, direct working style; comfortable mentoring junior engineers without taking over; preference for engineering solutions over staffing
