Staff Security Engineer

The Opportunity

Veo's security surface is unusual. We train models on-premise on dedicated GPU infrastructure, run the product across AWS and GCP, and operate a fleet of tens of thousands of cameras deployed at clubs and venues worldwide. That is a scope most SaaS security engineers never touch: physical devices in the field, heavy on-prem compute, and multi-cloud production, all in one role.

We are forming a Security Enablement Team that makes it easier for every engineering and IT team at Veo to build, ship, and operate secure systems. As the most senior engineer on the team, you will own the technical direction of the platform security, identity, and network security slice, partnering with the teams that own these systems so security is built in from the start. As an enablement function, the team does not run these systems day to day. We build the paved roads, tooling, and patterns that let the owning teams operate securely by default.

You will join during a pivotal moment. We are standing the team up, defining what good looks like across platform security, identity, and network security, and rolling out the first paved roads for image scanning, SBOM generation, CVE response, CI/CD identity, and a unified internal network across our datacenters (GCP, AWS) and offices (Miami, Berlin, and Copenhagen). You'll have direct impact on how 100+ engineers write, review and ship secure systems.

What You Will Do

You will join a focused platform security team and operate as its most senior engineer. Everything below follows the same pattern. We design the paved road, prove it works, and hand it to the team that will own it. We share ownership, pair on complex work, and rotate responsibilities, and we expect this role to set the bar.

Design and build the paved roads for image scanning, SBOM generation, and CVE response, running inside the pipelines teams already use, with findings routed to the owners who can fix them under tracked SLAs

Lead the design, reviews, and tooling for a unified internal network and VPN across GCP, AWS, and our Miami, Berlin, and Copenhagen offices, while the team that owns the network keeps running it

Work with the auth service maintainers on identity and access, including MFA rollouts, removal of shared accounts, and cleanup of long-lived tokens, so the patterns stay theirs to own

Make workload identity the paved road for CI/CD, using OIDC between GitHub Actions and AWS or GCP, packaged so teams can migrate themselves

Build audit logging as a shared capability that teams plug into rather than reinvent

Turn GRC controls into technical implementations, with evidence pipelines that produce auditable output without manual follow-up

Own the contracting cycle for external penetration tests and build the intake, classification, and tracking system that routes findings to named owners, while the owning teams remediate

Hand each capability off cleanly, with a runbook, a named owner, and an escalation path, and run office hours where product and platform teams can get a security review or a paved-road question answered

Mentor the rest of the team and raise the security bar across Builders

As the team matures, you will help shape our multi-environment network architecture, our identity and access patterns, and the long-term security posture of the product.

What You Could Bring

How We Work