Senior Security Engineer, Vulnerability Management, PSIRT - 1Password

About 1Password

At 1Password, we’re building the foundation for a safe, productive digital future. Our mission is to unleash employee productivity without compromising security by ensuring every identity is authentic, every application sign-in is secure, and every device is trusted. We innovated the market-leading enterprise password manager and pioneered Unified Access Management, a new cybersecurity category built for the way people and AI agents work today.

Over 180,000 businesses, from Fortune 100 leaders to innovative AI companies, trust 1Password to help their teams securely adopt the SaaS and AI tools they need to do their best work.

About the Role

We are excited to welcome a Senior Security Engineer to join our Product Security team. Product Security enables 1Password to build and deliver secure products with confidence, owning the end-to-end security lifecycle across products, platforms, and infrastructure.

In this role, you will lead and mature our incident response capabilities, working in close partnership with Engineering, Legal, Communications, and Customer Success to coordinate the company's response when product security incidents occur.

What You'll Do

• Lead end-to-end response to product security incidents, from discovery, triage, remediation, and disclosure.
• Own and evolve 1Password's PSIRT function, including incident classification frameworks, severity models, escalation paths, and response playbooks.
• Drive coordinated vulnerability disclosure (CVD) processes, partnering with our bug bounty program and external security researchers.
• Serve as the primary coordinator across Product Security, Engineering, Legal, Communications, and Customer Success during active security incidents.
• Lead post-incident reviews (PIRs) and translate findings into systemic improvements across products, processes, and detection capabilities.
• Develop and maintain incident response tooling, automation, and reporting that reduce time-to-detect and time-to-respond.
• Contribute to customer-facing security advisories, CVE disclosures, and public incident communications.
• Evaluate and integrate AI-powered tooling and workflows that improve the speed and effectiveness of incident detection and response.
• Mentor other engineers and help shape the long-term maturity of product security capabilities.
• Participate in an on-call rotation with out-of-business-hours coverage.

What We're Looking For

• 5+ years of career experience in IT or Engineering with a strong security focus.
• Hands-on experience leading or participating in security incident response, ideally within a SaaS product environment.
• Experience with coordinated vulnerability disclosure (CVD) and managing relationships with external security researchers.
• Strong judgment under pressure and the ability to make clear, defensible decisions during time-sensitive situations.
• Experience building or formalizing incident response capabilities from scratch (playbooks, runbooks, severity frameworks, escalation paths).
• Experience drafting customer security advisories, CVEs, or public-facing incident communications.
• Strong communication skills across technical and non-technical audiences, from engineers to executives.
• Comfort reading and writing code to support forensic analysis, automation, and tooling.
• Experience leveraging AI/ML capabilities to accelerate security workflows and automate repetitive tasks.

Bonus Points

• Familiarity with CVSS, EPSS, and vulnerability severity frameworks for incident prioritization.
• Experience in a consumer or B2B SaaS environment where customer trust and public perception are critical.
• Familiarity with Software Bill of Materials (SBOMs) and supply chain risk.
• Experience with compliance standards and certifications (e.g., SOC 2, ISO 27001).
• Relevant certifications such as GCIH, GCFE, GCFA, PNPT, or similar.

Compensation and Benefits

• Base Salary (US): $153,000 – $214,000 USD
• Base Salary (Canada): $144,000 – $202,000 CAD
• Equity grant (RSUs) and incentive program participation
• Comprehensive health and dental coverage
• Retirement matching (401k / RRSP)
• Generous paid time off (PTO)
• Maternity and parental leave top-up programs
• Free 1Password account