Engineering Manager - Security Engineering

Seattle Officefull timeOn Site

Apply on Employer Site

senior

$200k–$260k

H1B: no

Aircall Engineering Manager - Security Engineering at Aircall leads Security Engineering organization across Product Security, Infrastructure Security, Detection & Response, and GRC. Responsible for team growth, technical direction, and embedding security across the company.

Responsibilities

Scope of Responsibility:
Product Security
Own the Secure Software Development Lifecycle (SSDLC) from threat modelling through to production deployment.
Secure Agentic development practices by automating threat modeling, code reviews, internal pentesting and vulnerability remediation by building in-house security AI agents.
Partner with engineering to embed security reviews, static analysis (SAST), dependency scanning (SCA), and secrets detection into CI/CD pipelines.
Lead the Aircall Bug Bounty and Vulnerability Disclosure Program (VDP), triaging and remediating reports with engineering teams.
Drive regular penetration testing cycles for web, mobile, and API surfaces; oversee remediation tracking.
Champion a developer-centric security culture through security champions, training, and tooling that makes the secure path the easy path.
Infrastructure Security
Define and maintain the security architecture of Aircall's cloud infrastructure (AWS), with a strong emphasis on zero-trust, least privilege, and defence in depth.
Own, maintain and expand security observability through CSPM, CNAPP and CWPP tools like Wiz.
Enable agentic auto-remediations for security vulnerabilities.

Qualification

Familiarity with VoIPRelevant certificationsBase salary range

Required

7+ years of professional experience in security engineering.
3+ years in an engineering management or technical lead role with direct reports.
Proven track record of building and scaling security teams in a cloud-native, SaaS environment.
Deep technical fluency across at least two of the four pillars (Product Security, Infrastructure Security, D&R, GRC).
Hands-on experience with major cloud platforms (AWS strongly preferred, GCP or Azure a plus) and infrastructure-as-code (Terraform, CDK, or equivalent).
Experience owning or contributing to SOC 2 Type II, ISO 27001, or equivalent compliance programmes.
Demonstrated ability to communicate security risk clearly to non-technical executives and board members.
Experience running security incident response — from detection through containment, eradication, and post-mortem.

Preferred

Background in a high-growth B2B SaaS or cloud-communications company.
Familiarity with VoIP, real-time communications, or telephony security considerations.
Experience embedding Agentic AI practices into security engineering workflows and securing internal AI tooling and implementation.
Relevant certifications: CISSP, CISM, AWS Security Specialty, GIAC (GWAPT, GCIA, GCIH), or equivalent.
Experience running a Bug Bounty programme (HackerOne, Bugcrowd, or similar).
Contributions to the open-source security community, conference speaking, or published research.
Familiarity with DORA metrics and the relationship between deployment frequency and security posture.
Base salary range: