Senior Manager, Security Engineering

Location: Remote US

Department: Security

Location Type: REMOTE

Employment Type: FULL_TIME

• Hire, develop, and manage a team of security engineers across application, cloud, and infrastructure security
• Own the Security Engineering plan for the current and next quarter, based on the Security strategy
• Own the secure software development lifecycle (SDLC) program and its standards across all Engineering teams
• Run the security design review process for new features, partner APIs, payment flows, and AI features, and align review SLAs with the rest of the business
• Set the fix priority for security findings, with the risk to traveler, payment, and customer data as the main input, and escalate overdue critical findings
• Align security priorities with the business and development teams and keep them on the roadmap
• Own the SDLC, change management, and cloud configuration controls in PCI DSS, SOC 2, and ISO 27001 audits, with the GRC team
• Manage the annual external penetration test and the relationships with Security Engineering tool vendors
• Decide how the team splits its time between projects, design reviews, and findings
• Propose headcount, tool, and vendor spend for the team in the annual budget
• Report team metrics, such as open findings by severity and review cycle time, to Security leadership

• 10+ years of security engineering experience, with 3+ years as a manager of security engineers
• A record of hiring, developing, and managing the performance of security engineers
• Deep expertise in at least one of application security, cloud security (AWS), or infrastructure security, and working knowledge of the others
• Experience with a secure SDLC program: threat models, code and dependency scans, and security checks in CI/CD pipelines
• Ability to influence without authority and to communicate clearly to engineers, executives, and auditors
• Experience with PCI DSS, SOC 2, or ISO 27001 audits
• Fluency in at least one programming language, with the ability to review code and build security automation
• Java, Golang, and Python a strong plus
• Experience with an API-driven, multi-region SaaS platform a plus
• Familiarity with the security risks of Artificial Intelligence and Machine Learning features a plus
• Experience in travel technology or payments a plus

• New York Metro Area, San Francisco Bay Area, Seattle Metro Area: $186,900-$250,000
• California, New Jersey, Washington, New York, Washington, D.C., Massachusetts, Connecticut: $178,800-$238,000
• Hawaii, Alaska, Maryland, Illinois, New Hampshire, Oregon, Colorado, Virginia, Delaware, Minnesota, Rhode Island, Pennsylvania, Texas: $170,700-$226,000
• All other U.S. states: $162,600-$214,000

• Equity in the form of stock options, which provides partial ownership in the company, so you can share in the success of the company as it grows
• Pre-tax and ROTH 401(k) options via Fidelity with up to a 4% company match
• Comprehensive benefit plans covering medical, dental, vision, life, and disability effective on your hire date. We cover 100% of your employee premiums and 85% of your eligible dependents
• Pre-tax flexible spending account options for health, dependent care, and commuter expenses
• Flexible PTO in addition to 10 company holidays and an end-of-year company shutdown
• Up to 26 weeks of Parental Leave
• Monthly cell phone/internet stipend
• Extra perks — IATAN travel membership, pet insurance, financial wellness tools, Calm app access, and more