Lead Security Engineer at Buffer · LumiJobs

Responsibilities

We're hiring a hands-on security engineer to be the tech lead for Buffer's Security team. You'll work alongside Adnan, who has carried security at Buffer for years. Together, you’ll own security and compliance for a 15-year-old profitable company that is rebuilding itself around AI.
Two things make this the right moment. Buffer’s product surface is growing: in May, we launched a public GraphQL API with an MCP server and CLI. More than 35,000 organizations have connected an AI tool to Buffer, and we are planning to build a plugin ecosystem on top. Internally, we're becoming an AI-native organization: MCPs on our Claude Team plan, custom connectors, internal tools, and Roo, our own internal agent. We're small and lean, with few processes, and we run on trust around access and permissions. We don't want to lose that, but the surface now grows faster than one person can cover.
That means the usual security playbook won't work here. We don't buy enterprise plans for every tool, and we don't make people justify every access request. You’ll make the secure path the easy path to follow.
Who you’ll work with
You’ll report to Miguel, Engineering Manager for the Infrastructure and Security teams.
Day-to-day, the Security team is you, Adnan, and Miguel. Adnan knows how everything at Buffer fits together and where the sharp edges are. Together, you’ll own planned security work as well as the work that keeps the lights on: the security inbox, requests from other teams, maintenance, and chores. You’ll lead the team’s direction and standards.
Your peers from our Advocacy (customer support) and People teams will rely on you to support them with security and compliance needs that come up in their work, from customer security questions to vendor reviews and policy.
What you’ll be working on
🧭 Lead security at Buffer. Define the strategy and roadmap, set priorities, drive execution, and change how we work where it matters. If you see a problem outside your lane, say so and drive the fix.
🧰 Build. Identify the problem, define the solution, then build it with Adnan: tooling, automation, processes.
🔁 Put security in the development loop. Check on every PR, threat modeling in tech specs, dependency, secrets, and supply chain hygiene, and review steps that hold up as more of our code is written with AI agents.
🔐 Advance operational security. Secure our day-to-day operations to meet industry-wide standards while maintaining the flexibility afforded by Buffer’s high-trust environment.

Qualification

You write codeYou’ve worked with AWSYou’ve run a SOC 2 or similar programYou’re fluent with modern AI toolsYou thrive in remoteProductInfrastructureSecurity and complianceObservability and incidentsAIApply for the job

Required

You write code. You can read and change a TypeScript codebase well enough to ship a fix and review someone else’s (legacy PHP and Python show up more rarely, too).
You’ve led security incidents end-to-end, including the writing of status updates, customer comms, and postmortems that people act on.
You’ve worked with AWS, Kubernetes, and Cloudflare, or similar, enough to reason about infrastructure risk with an infrastructure team. You don’t need to run it.
You’ve run a SOC 2 or similar program, or worked closely with one, and you’d rather automate evidence collection than do it by hand.
You've run or triaged a vulnerability disclosure or bug bounty program, and you can tell a real report from noise quickly.
You’re fluent with modern AI tools, and you use them to multiply your output and your team’s. You’ve thought hard about securing systems that use them.
You thrive in remote, async environments, and you follow through. You're clear in your thinking and generous with context, and you close the loop on what you commit to. Most of your influence here will be written.

Preferred

Product. Node.js (TypeScript) across most services in a monorepo, backed by MongoDB; a REST API and PHP being retired for legacy services. iOS and Android apps. A public GraphQL API, MCP server, CLI, and connectors.
Infrastructure. AWS (EKS, IAM, SQS, S3, CloudFront), Terraform, ArgoCD, GitHub Actions, Cloudflare (WAF, Zero Trust, Workers, DNS).
Security and compliance. Vanta for SOC 2, Dependabot, gitleaks, AWS GuardDuty, Cloudflare WAF and Zero Trust, Action1 for device management, 1Password, and Google Workspace as the identity layer.
Observability and incidents. Datadog, Sentry, incident.io, and PagerDuty.
AI. Claude Team across the company, internal agents and MCP servers built in-house, in-product AI features.
Apply for the job
Do you believe you're a fit for this role and want to join the Buffer team? We'd love to hear about you!
Here's what our hiring process looks like:

Lead Security Engineer

Responsibilities

Qualification

Required

Preferred

Company

Buffer

More roles at Buffer