Lead Security Engineer at Buffer – Fully Remote Role with Transparent Pay
Buffer, the social media management platform known for its radical transparency, is hiring a Lead Security Engineer. This is a hands-on senior role on a small, fully distributed team at a profitable company that is actively rebuilding around AI.
- Employer: Buffer
- Job Title: Lead Security Engineer
- Requisition ID: 9eed68be-5967-43e6-bb17-3dad6d966747
- Salary: $171,100 – $222,880 USD + equity
Location eligibility: Fully remote, open to candidates living in Europe, Africa, the Middle East, or eastern South America
Remote classification: Fully remote (timezone-restricted)
Employment type: Full-time
Why this role exists right now
Buffer has been fully remote for years and is known for public salary transparency, a 4-day work week experiment that stuck, and a high-trust culture. In 2026 the company is expanding its AI surface significantly. It launched a public GraphQL API with an MCP server and CLI earlier in the year. More than 35,000 organisations have already connected AI tools to Buffer, and a plugin ecosystem is planned.
Internally, Buffer is becoming AI-native with company-wide Claude access, custom connectors, and its own internal agent. The security surface is growing faster than one person can cover while still keeping the high-trust, low-process environment that makes Buffer distinctive. That is why they are hiring a hands-on Lead Security Engineer rather than a pure policy or CISO-style role.
What the role actually involves
You will be the technical lead for security, working day-to-day with the existing security engineer (Adnan) and reporting to the Engineering Manager for Infrastructure and Security (Miguel). The security “team” is deliberately small: you, Adnan, and Miguel.
Core responsibilities include:
- Setting the security strategy and roadmap and driving execution
- Building tooling, automation and processes (not just writing policies)
- Embedding security into the development process — PR reviews, threat modelling in tech specs, dependency and supply-chain hygiene, and reviews that still work when more code is written by AI agents
- Leading security incidents end-to-end (status updates, customer communication, actionable postmortems) and participating in the engineering-wide on-call rotation
- Running tabletop exercises
- Securing the growing AI surface (agents with tool access, connectors, in-product AI, public GraphQL API and MCP server)
- Owning vulnerability disclosure / bug-bounty triage
- Advancing SOC 2 and other compliance work, with a preference for automating evidence collection
- Supporting customer security questionnaires and helping build self-service trust materials (for example a Trust Center)
- Keeping the lights on — security inbox, requests from other teams, maintenance and chores — and automating as much of that as possible
Buffer is explicit that the usual large-company security playbook will not work here. They do not want a gatekeeper. They want someone who makes the secure path the easy path while protecting the high-trust culture.
Key requirements (straight from the official listing)
Buffer is looking for someone who has already operated as the senior security person without a large CISO structure above them. You need to be comfortable setting direction through the quality of your work rather than formal authority.
Must-have experience and skills:
- Hands-on application and API security in a multi-tenant SaaS environment, ideally one with a public API — authorization models, OAuth/OIDC, session and auth flows, IDOR, SSRF, and threat modelling. You have found and fixed these classes of bugs, not only reported them.
- Ability to read and change TypeScript code well enough to ship fixes and review others’ code (legacy PHP and Python appear less often).
- End-to-end incident leadership experience, including clear written communication and postmortems that lead to real change.
- Working knowledge of AWS, Kubernetes and Cloudflare (or similar) sufficient to reason about infrastructure risk with the infrastructure team. You do not need to operate the infrastructure yourself.
- Experience running or working closely with a SOC 2 (or similar) programme, with a preference for automation over manual evidence collection.
- Experience triaging vulnerability disclosure or bug-bounty reports and distinguishing real issues from noise.
- Strong written communication and follow-through in a remote, asynchronous environment. Most of your influence will be written.
- Based between UTC-3 and UTC+3 so you can share incident coverage with the existing security engineer in Sri Lanka and have reasonable overlap with most of the Engineering team.
Nice-to-haves include being a Buffer user or having familiarity with social media management tools, and fluency with modern AI tools for personal and team productivity while thinking carefully about how to secure systems that use them.
Compensation and benefits context
The posted range is $171,100 – $222,880 USD plus equity. Buffer has practised radical salary transparency for over a decade and publishes its compensation philosophy and (historically) individual salaries. The company has moved toward more location-independent pay over time and no longer negotiates individual offers in the traditional way — the salary system itself is the negotiation.
This is useful context if you are used to negotiating hard against opaque ranges. For related guidance on handling posted ranges and transparency laws, see our existing articles:
- Negotiate Salary When the Pay Range Is Posted (2026 Guide)
- Pay Transparency Laws 2026: US States & Canada Cheat Sheet
Additional Buffer benefits commonly mentioned include a 4-day work week structure, home-office setup support, growth/learning funds, AI tools stipend, flexible time off, family leave, and profit sharing when the company does well. Always confirm the latest package on the official careers page.
Who this role is a strong fit for
This is not an entry-level or purely policy role. It suits experienced security engineers who:
- Prefer small, high-trust teams over large corporate security organisations
- Enjoy writing code and shipping automation as much as (or more than) writing policy documents
- Are comfortable with the ambiguity and speed of a profitable but still lean SaaS company that is investing heavily in AI
- Can operate effectively in a fully remote, largely asynchronous environment with clear written communication
- Are located in the required timezone band (this is a hard requirement for shared incident coverage)
If you are based in South Africa, parts of Europe, North Africa or the Middle East that fall inside UTC-3 to UTC+3, the timezone restriction is workable. Buffer has a long history of hiring globally and supporting remote work properly.
How to prepare a strong application
Buffer’s process is designed to be thorough and respectful of candidates’ time:
- Short application form (CV, LinkedIn, a few yes/no questions, and a writing sample)
- Questionnaire if there is a match
- Interviews with the hiring manager and other teammates
- Take-home exercise
- Meeting with the CEO
- Paid collaboration period (two days working on a real project)
Practical tips:
- Show concrete examples of application/API security work you have done yourself (finding and fixing issues, not only managing a team that did).
- Highlight any experience securing AI features, public APIs, or multi-tenant systems.
- Demonstrate that you can write clearly — the writing sample and all communication will be evaluated.
- Be ready to discuss how you would balance high-trust access with growing attack surface.
- Mention any relevant SOC 2, vulnerability disclosure, or incident leadership experience with specific outcomes.
For broader remote-job and career advice that pairs well with this listing, see:
- Work From Home Jobs in South Africa
- Cybersecurity Certification ROI
- Top Certifications That Can Fast-Track Your Career
- Best AI Tools for Remote Workers
How to apply (and how to stay safe)
Apply only through the official Buffer form on the vacancy page linked here. Buffer has publicly warned that scammers are using its name. Legitimate applications are accepted only via the forms on buffer.com/journey.
Never send money, share bank details, or move the conversation off the official Buffer domain. If someone contacts you claiming to be from Buffer recruiting and asks you to use a different email address, Telegram, WhatsApp, or a non-Buffer form, treat it as a scam.
Verification note
Independently verified on Buffer’s official careers portal. The vacancy was still live and accepting applications at that time. Always re-check the official page before applying, as roles can close without notice.
No comments:
Post a Comment