Senior/Staff Security Engineer (Product Security)

Join Zipline, a mission-driven company that is revolutionizing the delivery of critical goods. As a Senior/Staff Security Engineer, you will be responsible for protecting systems that directly impact safety, regulatory compliance, and uninterrupted delivery. You will own security for production services and integrations, deliver measurable risk reduction, design and implement production controls, lead vulnerability management, and collaborate with various teams. This is a hybrid onsite role based in South San Francisco, with occasional travel to distribution centers and test sites.

• Assumer la responsabilité de la sécurité des services de production et des intégrations qui gèrent l'orchestration de la flotte, l'automatisation du centre de distribution, la télémétrie/téléopération, et les chaînes d'outils de développement.
• Définir des métriques de référence et être responsable de l'amélioration de ces métriques, en réduisant les risques dans les systèmes de production sous pression opérationnelle.
• Concevoir et mettre en œuvre des contrôles de production, y compris les politiques IAM, la confiance entre services, la télémétrie et l'alerte en temps réel, et les pipelines CI/CD sécurisés.

• 8+ years building and operating security controls for large-scale production systems across application and cloud infrastructure
• Demonstrable hands-on engineering ability: you ship automation or tooling in Python, Go, or similar and can build integrations with AI tools and agentic security bots (not only write policies)
• Deep practical experience with cloud-native stacks and microservices (Kubernetes, containers, IAM, CI/CD, secrets management, logging/telemetry) and with designing least-privilege service-to-service models
• Prior ownership of vulnerability management, incident response playbooks, and verification processes for production services
• Ability to define and track quantitative success metrics (MTTD, MTTR, number of exploitable findings, compliance audit readiness) and be accountable for meeting targets within 6–12 months
• Direct experience threat‑modeling and securing systems that interface with physical systems, regulated workflows, or third-party partners (embedded, teleoperation, field ops, or healthcare-adjacent data flows)
• Skeptical, adversarial mindset: anticipates failure modes and abuse cases for systems that interact with the physical fleet and partner workflows
• Operates as a technical owner: can persuade engineering teams, prioritize trade-offs, and drive changes through to production without relying solely on policy enforcement
• Experience securing LLM/agentic tools in engineering workflows and mitigating OWASP LLM risks (prompt injection, unsafe plugin/output handling, agentic privilege misuse)
• Background across multiple domains (cloud infra, web services, and embedded/autonomy) and experience building developer-friendly security platforms or paved-road tooling