Senior / Staff Security Engineer

About the Role

At Linear, we are committed to quality. Security is an essential part of that quality — not a layer that we add later, but something we build in from the start. As Security Engineer at Linear, you'll be operating in a high-autonomy role with real scope, doing hands-on security work across the product and infrastructure we build.

Linear is a remote-first company. This role is open to candidates based anywhere in North America.

What You’ll Do

• Operate, automate, and extend vulnerability management end-to-end: triage, prioritize, and drive remediation across product, infrastructure, and dependencies, and keep SLAs meaningful.
• Run our bug bounty program: triage incoming reports, validate severity, work with engineering on fixes, and maintain responsive researcher relationships.
• Lead product security testing: threat model new features (including AI/agent-facing surfaces), review designs and code for security-relevant risk, and perform hands-on manual and tool-assisted testing.
• Be a primary responder for security incidents: lead investigation and containment, drive postmortems, and convert lessons into concrete hardening work.
• Own meaningful chunks of our cloud/infra security posture on GCP/k8s/Postgres: harden configurations, close audit/scanning gaps, and partner with infra engineering on secure defaults.
• Build and maintain security tooling and automation, including leveraging AI/LLM tooling to speed up triage, code review, and repetitive investigation work.
• Partner with the GRC/Trust function: feed real findings into the risk register and control evidence, ensuring compliance reflects engineering practice.

What We’re Looking For

• 5+ years of experience across security engineering, with depth in at least two of: vulnerability management, product/appsec testing, incident response, and cloud security.
• Hands-on technical capability: can read and reason about code (heavy TypeScript usage), comfortable in cloud environments (GCP a plus), and capable of going deep on technical findings.
• Experience leveraging AI coding/security tools as force multipliers (Claude, Linear Agent, etc.).
• Calm under pressure, able to lead incidents from initial alert through postmortem independently.
• Pragmatic builder mindset: prefers scripting and tooling over repetitive manual work, focused on actual risk reduction over compliance checkboxes.
• Strong autonomy and clear communication skills to articulate technical findings to non-technical stakeholders.