Lead Security Engineer

ABOUT BUFFER

We create social media and brand-building software for small businesses, creators, and individuals. Our mission is to provide essential tools to help small businesses get off the ground and grow. Through exceptional customer service and uplifting content, we help our customers believe they can succeed and do good along the way.

Buffer is a fully distributed team, and we’ve always aimed to do things a little differently. Since the early days, we’ve focused on building one of the most unique and fulfilling workplaces by rethinking a lot of traditional practices. We also default to transparency, so you can read all about our metrics, and our successes and failures along the way on our Transparency Dashboard https://buffer.com/open.

We're united by Buffer's values https://buffer.com/about#values, and we hire and work from all over the world. We strive to create a diverse and inclusive work environment, and we are building a culture where underrepresented groups are welcome and can flourish. Please note that we do travel to work together in person once or twice per year, and those events are highly encouraged to build deeper connections among our small team.

As you get to know Buffer and consider joining the journey, you can learn more about Buffer on our Journey https://buffer.com/journey page. Still curious to learn more about the experience on the Buffer team? Feel free to read more from Kirsti https://buffer.com/resources/first-30-days-buffer/ and Sabreen https://buffer.com/resources/joined-3-days-before-the-retreat/ as they share their first experiences with Buffer, as well as from Hailley https://buffer.com/resources/8-years-at-buffer/, who captured why she still calls Buffer home after 8+ years.

While unusual at Buffer, we're looking for folks in a specific timezone range. This role is currently open to candidates based between UTC-3 and UTC+3. That gives you overlap with our current security engineer in Sri Lanka and most of our Engineering team, and lets the two of you share incident coverage so neither of you has to work through the night.

ABOUT THE ROLE

We're hiring a hands-on security engineer to be the tech lead for Buffer's Security team. You'll work alongside Adnan https://www.linkedin.com/in/adnanissadeen/, who has carried security at Buffer for years. Together, you’ll own security and compliance for a 15-year-old profitable company that is rebuilding itself around AI.

Two things make this the right moment. Buffer’s product surface is growing: in May, we launched a public GraphQL API with an MCP server and CLI. More than 35,000 organizations have connected an AI tool to Buffer, and we are planning to build a plugin ecosystem on top. Internally, we're becoming an AI-native organization: MCPs on our Claude Team plan, custom connectors, internal tools, and Roo, our own internal agent. We're small and lean, with few processes, and we run on trust around access and permissions. We don't want to lose that, but the surface now grows faster than one person can cover.

That means the usual security playbook won't work here. We don't buy enterprise plans for every tool, and we don't make people justify every access request. You’ll make the secure path the easy path to follow.

Your role will be to set the direction for security at Buffer and to do much of the work yourself. You'll decide which open security problems to address first, write code to fix some of them, and lead incidents when they happen. We're looking for an enabler and a team player, not a gatekeeper. This is a generalist role by design.

WHO YOU’LL WORK WITH

You’ll report to Miguel, https://www.linkedin.com/in/migueldavid/ Engineering Manager for the Infrastructure and Security teams.

Day-to-day, the Security team is you, Adnan, and Miguel. Adnan knows how everything at Buffer fits together and where the sharp edges are. Together, you’ll own planned security work as well as the work that keeps the lights on: the security inbox, requests from other teams, maintenance, and chores. You’ll lead the team’s direction and standards.

You will also work closely with product engineering teams to ensure that what we build meets a strong security bar. That means collaborating on tech spec reviews and growing the group of security champions across the teams.

Your peers from our Advocacy (customer support) and People teams will rely on you to support them with security and compliance needs that come up in their work, from customer security questions to vendor reviews and policy.

WHAT YOU’LL BE WORKING ON

• Lead security at Buffer. Define the strategy and roadmap, set priorities, drive execution, and change how we work where it matters. If you see a problem outside your lane, say so and drive the fix.
• Build. Identify the problem, define the solution, then build it with Adnan: tooling, automation, processes.
• Put security in the development loop. Check on every PR, threat modeling in tech specs, …