Sr. Corporate Security Engineer - Material Security

Material works with some of the most sophisticated security teams in the industry. These customers have entrusted us with protecting one of their most critical assets: Google Workspace. Your mission is to make our own corporate environment worthy of that trust: take a mature security program and make it rigorous, measured, and adapted to the new generation of LLM-based security tooling.

Concretely: bring your experience to identify and close gaps in our environment, rebuild our detection and response around LLMs — and be customer zero for our own product, working with Engineering to turn what you learn into detection improvements that ship to every customer.

The environment includes a Mac-only fleet, Google Workspace, SIEM, IdP, EDR, fleet management, and a cloud production environment.

You Might Be This Person If

• You have owned a corporate stack end to end — devices, identity, SaaS, collaboration — and turned deployed controls into enforced controls.
• You treat the IdP, the device fleet, and the SaaS estate as one system, hardening paths between them rather than tools in isolation.
• You have written detections that caught real attacks, eliminated noise, and measured the efficacy.
• You have responded to live incidents, made containment calls, and know what to revoke first.
• Your instinct is to build systems to eliminate manual, repetitive work.
• You have implemented an LLM into a security workflow, measured it, and hold specific views on where it should and should not be trusted.
• You work through design decisions by asking questions on both sides and respect final team calls.
• Bonus: You have published a technical paper, spoken at a conference, or maintain open-source security tools.

Responsibilities

• Detection and Response (own): Own corporate telemetry and detection content. Close coverage gaps, reduce noise, and develop detections for account takeover, session token theft, malicious OAuth grants, admin abuse, and insider exfiltration. Lead corporate incident response and own playbooks.
• LLM-Driven Triage (own): Design and build the agent that reviews privileged access grants, customer data access, and high-fidelity endpoint and identity alerts in near real time, with labeled evaluation sets, measured precision/recall, and defense against prompt injection.
• Endpoint (shared with CorpSec): Manage device management and endpoint detection for the Mac fleet. Automate update enforcement, deepen EDR coverage, bring browser-level DLP to the fleet, and enforce BYOD posture on iOS and Android.
• Identity and SaaS (shared with CorpSec): Manage the identity provider and SaaS estate. Maintain phishing-resistant authentication, handle non-SSO applications, automate access-review evidence, and build review pipelines for vendors and OAuth applications.
• Google Workspace (shared with CorpSec): Oversee admin alerting, OAuth governance, Apps Script governance, sharing, and DLP. Partner with Engineering to propose, test, and ship detection updates back to our core product.
• Corporate to Production (shared with AppSec): Secure the boundary between corporate and production, including cross-boundary detections, just-in-time access, and logging.

What We’re Looking For

• Operator Depth: 6+ years in corporate or enterprise security or detection and response, with hands-on ownership of a SIEM, detection content, and incident response.
• Software Engineering: Comfortable in Python, Go, or TypeScript working directly against vendor APIs to automate security enforcement.
• Identity Fundamentals: Deep understanding of OAuth, SAML/OIDC, session and token lifecycles, and cloud IAM integrations.
• Endpoint Fluency: Experience managing a Mac fleet with modern MDM and EDR, taking policies from deployed to enforced.
• Applied LLM Judgment: Experience building or experimenting with LLM-driven workflows, including prompting, tool use, and evaluation frameworks.
• Software Development (nice to have): Experience contributing detection logic or security features to product codebases within standard software engineering review workflows.
• How You Work: Collaborative, curious, direct, and focused on engineering solutions rather than staffing around problems.