Sunset Security Lead at Sunset responsible for leading security across company products, cloud systems, and enterprise data. This hands-on role involves writing code, reviewing architecture, testing systems, and creating secure defaults.
Responsibilities
Sunset handles internal enterprise data from collaboration tools, documents, files, and business systems, then transforms it into de-identified datasets that remain useful. We also build software that can retrieve information, guide workflows, and take carefully bounded actions. Security is part of whether these products can exist, not a review added after they are built.
This is a hands-on individual-contributor role. You will write code, review architecture, test technical and human systems, lead exercises and incidents, and create secure defaults other teams can operate. You own the company-wide security program, but the people who run each product, system, and operation remain responsible for implementing and following its controls. You are not a one-person IT, legal, compliance, or operations department.
Problems You Might Own
Keep sensitive data inside explicit boundaries
Trace how customer data, credentials, derived artifacts, and delivery outputs move through SaaS applications, workers, data pipelines, review tools, logs, storage, and third parties. Build controls that make tenant isolation, access, retention, deletion, quarantine, and delivery decisions enforceable and auditable rather than dependent on convention.
Give people and AI systems only the authority they need
Design identity, authorization, and credential systems for employees, contractors, customers, services, and AI-assisted workflows. You might build just-in-time access, scoped tool contracts, approval boundaries, safe execution environments, or protections against prompt injection, confused-deputy behavior, and data exfiltration.
Secure how the company and its people operate
Design security into employee onboarding and offboarding, devices, accounts, contractors, vendors, support access, and sensitive human workflows. On the Dissolution side, that includes identity verification, approval boundaries, segregation of duties, document and credential handling, consequential actions, exception paths, and an audit trail that shows who did what and why.
Make the secure path the easiest path
Build paved roads that catch important problems early without creating a security queue. This could include high-signal code and architecture review, secrets and sensitive-data detection, reusable authorization patterns, dependency and cloud controls, release checks, incident tooling, or automated evidence that serves both engineers and customer trust.
Establish Sunset's company-wide security program, current attack surface, highest-consequence risks, and prioritized roadmap
Qualification
This Role May Not Be for You If
Required
You are a strong software engineer with security as a core specialty, and you are comfortable building controls rather than only recommending them
You can reason deeply about application security, identity and authorization, multi-tenant systems, cloud infrastructure, sensitive data, secrets, and incident response
You think like both a builder and an attacker and can explain the actual abuse path, affected asset, likely impact, and useful mitigation
You create low-friction defaults and clear decision boundaries instead of making Security the approval step for routine work
You can secure human workflows with approvals, separation of duties, training, evidence, and monitoring without pretending every risk has a software-only solution
You can communicate risk honestly to engineers, executives, customers, and auditors without using certainty you do not have
You use modern AI engineering tools fluently and understand their authority, data, dependency, prompt-injection, and verification risks
This Role May Not Be for You If
You want a compliance-only role centered on collecting evidence and administering frameworks
You prefer producing findings or policies to implementing and verifying durable controls
You treat every possible vulnerability as equally urgent or use Security as an unconditional veto without explaining the tradeoff
You want a narrow specialty with established teams to own every adjacent system and decision
