Security Engineer

As a Security Engineer II, you'll help advance Starburst's Application Security program by building the automation and tooling that allows a small team to secure a large engineering organization. You'll take security problems and turn them into reliable, automated systems, using AI where it adds leverage. This is a hands-on engineering role: you'll write production code, integrate security checks into CI/CD pipelines, and build automation and guardrails the program depends on.

You don't need deep specialist expertise in vulnerability management or offensive security. What matters is a solid information security foundation, strong engineering skills, and the judgment to make sound security tradeoffs. This role offers room to grow your security depth and take on broader product security responsibilities over time.

You'll work closely with Engineering and Product.

• Build automation and tooling for the Application Security program, turning manual, repetitive, or hard-to-scale security work into reliable automated systems, increasingly powered by AI.
• Integrate security into the development lifecycle, enabling automated security checks within CI/CD pipelines and building reusable guardrails and secure-by-default components.
• Support and extend our security stack (SAST, DAST, SCA, secrets scanning), connecting tools so findings reach the right engineering team quickly and helping developers interpret and remediate them.
• Apply AI to scale security work, prototyping and productionizing AI-assisted workflows for triage, analysis, and remediation.
• Support vulnerability management operations, helping detect, triage, and route newly disclosed vulnerabilities, and making that process faster and more consistent.
• Make sound security tradeoffs and help improve secure coding standards, documentation, and remediation playbooks.

• Bachelor's degree in Computer Science, Engineering, MIS, or equivalent practical experience.
• 2–4 years of experience in security engineering, software engineering, or a related technical role.
• A solid foundation in information security fundamentals, with the judgment to make sound security tradeoffs.
• Strong understanding of application vulnerabilities and mitigation strategies (OWASP Top 10, CWE).
• Demonstrated experience building automation and tooling, especially using AI, to solve real problems.
• Experience with one or more languages such as Python, Go, Java, or JavaScript/TypeScript (Java and Python preferred).
• Experience with CI/CD tooling, Git-based workflows, and modern development practices.
• Familiarity with cloud security concepts and hands-on experience with at least one cloud platform (AWS, Azure, or GCP).
• Experience in enterprise B2B software, self-managed and/or SaaS, is a plus.
• Ability to Travel: This role will require 25% in-person travel for purposes including but not limited to new hire onboarding, team and department offsites, customer engagements, and other company events. Actual travel expectations may vary by role and business needs.