Security Engineer, Vulnerability Management & Security Operations

Overview

Build and run LiveKit's vulnerability management and security operations program, working within a small Trust team covering security, IT and compliance.

What you'll do

• Select, deploy and operationalize scanning tooling across production assets.
• Run vulnerability management end to end: triage, severity in our environment, owner assignment, remediation SLAs and reporting.
• Build engineering-first triage and remediation workflows that fit how engineering teams already work, and automate the routing and follow-up.
• Build a remediation dashboard that engineering and leadership read and act on.
• Automate collection of the vulnerability management evidence our compliance programs depend on, in partnership with the Compliance team.
• Build automation, including agentic tooling, that removes manual security operations work and keeps pace with engineering growth.

What you'll need

• 5+ years in security engineering, security operations or software engineering, with a significant share of that focused on security.
• Hands-on experience building or running a vulnerability management program or software security tooling (SCA, container, cloud or host scanning).
• An engineering-first approach to triage and remediation: you get findings fixed by making the fix easy to ship.
• The judgment to set a finding's real severity in our environment, using CVSS as one input.
• Strong scripting and automation skills in a language such as Go or Python, and comfort reading infrastructure as code such as Terraform.
• A pragmatic approach to risk: you can explain why a finding matters to the business and how fast it needs to be fixed.
• You think like both a builder and a breaker and understand security from first principles.
• You take an automation-first and pragmatic approach to risk mitigation.
• You translate security concerns into engineering action and clearly explain complex technical concepts to others.
• You are a fast learner and thrive in ambiguity.

Nice to have

• Experience with real-time media, networking or WebRTC systems.
• Experience supporting compliance audits such as HIPAA, PCI-DSS, ISO 27001 or SOC 2.
• Incident response or application security experience.
• Experience in AI security, such as securing LLM applications or agent infrastructure.

Details

• Location: United States (Remote).