> Markdown version of [/jobs/ext/4585899-senior-staff-security-engineer-copy](https://www.wearedevelopers.com/jobs/ext/4585899-senior-staff-security-engineer-copy). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Staff Security Engineer (Copy)

- **Company:** Spotnana, Inc.
- **Location:** San Francisco, CA, United States
- **Experience:** Expert
- **Salary:** $170,700 - $226,000
- **Contract:** Permanent contract
- **Skills:** Java (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Software as a Service, Cloud Computing, Cloud Computing Security, Code Review, Cyber Security, Customer Data Management, Payment Systems, Python (Programming Language), PCI Data Security Standards, Systems Development Life Cycle, Software Engineering, Software Security, Api Design, Security Orchestration, Automation & Response, Golang, Programming Languages
- **Published:** November 5, 2026
- **Apply:** https://www.careerbuilder.com/job-details/senior-staff-security-engineer-copy--0d35a269-a910-42b2-b653-b718152d2e06

## About the Role

Travel Industry, Risk Analysis, Team Building, Team Lead/Manager, Computer Security, Code Reviews, Software Engineering, Cloud Applications, Applications Security, Software Development Lifecycle (SDLC), * 10+ years of security engineering experience, with 3+ years as a manager of security engineers

 * A record of hiring, developing, and managing the performance of security engineers
 * Deep expertise in at least one of application security, cloud security (AWS), or infrastructure security, and working knowledge of the others
 * Experience with a secure SDLC program: threat models, code and dependency scans, and security checks in CI/CD pipelines
 * Ability to influence without authority and to communicate clearly to engineers, executives, and auditors
 * Experience with PCI DSS, SOC 2, or ISO 27001 audits
 * Fluency in at least one programming language, with the ability to review code and build security automation
 * Java, Golang, and Python a strong plus
 * Experience with an API-driven, multi-region SaaS platform a plus
 * Familiarity with the security risks of Artificial Intelligence and Machine Learning features a plus
 * Experience in travel technology or payments a plus, Selected candidates will participate in cross-functional virtual interviews exploring their relevant experience, approach to problem-solving, critical thinking, and alignment with Spotnana's core values. Interviews will include face-to-face conversations as well as coding exercises to demonstrate your ability.

## Description

Spotnana is seeking an experienced Senior Manager, Security Engineering to lead the Security Engineering team in our global Security organization. You will run Security Engineering for Spotnana's travel platform and corporate systems and you will build a team of security engineers who make security part of how Spotnana builds software. Security at Spotnana advises Engineering and does not manage it, so you will win agreement from Engineering leaders through clear risk analysis and practical solutions. The ideal candidate is a hands-on leader who reviews designs and code, hires and develops strong engineers, and turns security strategy into a quarterly plan that the team delivers. You will report to the Head of Security & IT.
How you'll help us build

 * Hire, develop, and manage a team of security engineers across application, cloud, and infrastructure security
 * Own the Security Engineering plan for the current and next quarter, based on the Security strategy
 * Own the secure software development lifecycle (SDLC) program and its standards across all Engineering teams
 * Run the security design review process for new features, partner APIs, payment flows, and AI features, and align review SLAs with the rest of the business
 * Set the fix priority for security findings, with the risk to traveler, payment, and customer data as the main input, and escalate overdue critical findings
 * Align security priorities with the business and development teams and keep them on the roadmap
 * Own the SDLC, change management, and cloud configuration controls in PCI DSS, SOC 2, and ISO 27001 audits, with the GRC team
 * Manage the annual external penetration test and the relationships with Security Engineering tool vendors
 * Decide how the team splits its time between projects, design reviews, and findings
 * Propose headcount, tool, and vendor spend for the team in the annual budget
 * Report team metrics, such as open findings by severity and review cycle time, to Security leadership