Collective

Senior/Staff Security Engineer

San Francisco · Staff+

Sponsorship not specifiedDetected 47 days ago

PythonDjangoAWSOAuthAgentic AICybersecurityAccounting

About the role

You'll set the direction of this work, not just execute it: what gets built and in what order.
You'll sit on the Security team and spend your days in the product codebase, working alongside product engineers.
Extend those patterns to delegated and agent-based access: how AI agents and third parties act on a member's behalf with scoped, time-boxed, revocable authority - and how their actions are attributed and audited.

Own the end-to-end authentication and authorization architecture of Collective's member platform - session management, multi-factor authentication, authorization enforcement, and machine-to-machine authentication - and personally design, write, and ship the changes that improve it.
Drive the programmatic protection of sensitive member data: design and implement application-layer encryption for member documents and data - key management, envelope encryption, rotation - and build the controls that protect sensitive data in code (scoped access, tokenization, redaction in logs and pipelines) rather than in policy.
Lead the design process for the systems you own: write RFCs, run design reviews, and bring product engineers along on security-critical changes.
Threat-model the identity and data-protection systems you build, and own remediation of findings that touch your domain.
8+ years of software engineering experience, including significant time building or owning authentication, identity, authorization, or data-protection systems in production.
Practical applied-cryptography literacy: envelope encryption, KMS-based key management, key rotation, and the tradeoffs of encrypting data at the field, document, and storage layers.
Comfort operating as a senior individual contributor who influences platform direction through RFCs, design reviews, and working code rather than a management chain.

Deep security specialization is not required - you'll have teammates who bring it
the ability to hold security rigor and member experience in the same frame - auth flows are the front door of the product, and getting them wrong in either direction is expensive.
Product empathy: the ability to hold security rigor and member experience in the same frame - auth flows are the front door of the product, and getting them wrong in either direction is expensive.

Collective is on a mission to redefine the way businesses-of-one work.
Our technology and team of trusted advisors help members achieve financial independence by taking care of everything from business incorporation to accounting, bookkeeping, tax services, and access to a thriving community, all in one integrated platform.
We believe in empowering self-employed people to enjoy the same tax savings that big companies get, so they can focus on their passion, not paperwork.
Featured in Forbes, Business Insider, Yahoo, Bloomberg, Financial Times, TechCrunch, and more.
We are backed by General Catalyst, Sound Ventures (Ashton Kutcher and Guy Oseary), QED Investors, Google's Gradient Ventures, Expa, and other investors who have financed iconic companies like YouTube, Substack, Twitch, Box, Hims, Instacart, and Lyft.

This listing is sourced directly from Collective's careers page and normalized into a canonical job model.