Open to any country, as long as your working hours sit between UTC-3 and UTC+3.
Direct from the employer's own careers page
Who can apply
Read straight from the listing, so you know before you spend time on it.
Open to any country, as long as your working hours sit between UTC-3 and UTC+3.
“This role is currently open to candidates based between UTC-3 and UTC+3.”
Team members are distributed globally, with this role requiring overlap between UTC-3 and UTC+3 alongside colleagues in Sri Lanka and across Engineering.
- Async-first
- The listing doesn't promise async-first working.
- Contractor / B2B
- No mention of hiring international contractors or invoicing.
- Global stipend
- No home office or equipment budget mentioned.
- Annual retreat
- The team travels to work together in person once or twice per year.
Read from the listing automatically. Always confirm the details with the company before you accept an offer.
About the role
As the tech lead for Buffer's Security team, you will set the direction for security and compliance across a high-trust, AI-native environment while doing hands-on technical work. You will decide which security initiatives to prioritize, write code to automate and resolve issues, partner with product teams on architecture and code reviews, lead incident responses, and establish guardrails for Buffer's internal agents and AI integrations.
What you'll do
- Define security strategy, roadmap, and standards across Buffer and drive execution.
- Build security tooling, automation, and processes to keep operational overhead low.
- Embed security into the development lifecycle, including threat modeling, PR checks, and dependency hygiene.
- Lead security incident response, engineering-wide on-call rotation participation, and tabletop exercises.
- Secure Buffer's expanding AI surface, including agents with tool access, MCPs, and connectors.
- Own vulnerability disclosure, customer trust requests, and compliance frameworks such as SOC 2.
What you bring
- Prior experience operating as a senior or lead security engineer without a CISO above you.
- Deep application and API security expertise in multi-tenant SaaS environments (OAuth/OIDC, session flows, IDOR, SSRF).
- Proficiency writing and reading code to ship fixes and review PRs, particularly in TypeScript.
- Demonstrated experience managing security incidents end-to-end, including customer communications and postmortems.
- Working familiarity with cloud and infrastructure technologies such as AWS, Kubernetes, and Cloudflare.
About Buffer
Buffer builds social media and brand-building software for small businesses, creators, and individuals. Operating as a fully remote team for over a decade, Buffer defaults to transparency, experimentation, and trust.
View Buffer profile & open roles →