Role summary: As a Senior Security Engineer, you own the security of a shipped product end-to-end—the machine, its operating system image, the software it runs, the cloud service that commands it, and the update path.

What you\'ll own: - The threat model: define and maintain trust boundaries between the device, cloud, operators, update mechanisms, remote support, and suppliers. - Security design reviews: review designs early; keep records of your reviews. - Device identity and key custody: own the threat model, verification priorities, and the platform-side integration with the OS image. - Independent security testing: scope, environment, triage, remediation, and retest evidence. - Finding and fixing weaknesses: triage and fix weaknesses across code, dependencies, device images, and cloud; track findings to closure and report status. - Incident response: drive detection, triage, containment, evidence collection, and post-incident changes with reliability teams. - Customer security reviews: validate statements with evidence (versioned implementations, configurations, and operational records). - Cloud posture: manage identity, access, secrets, and infrastructure-change reviews with cloud provider signals. - Security and privacy controls: ensure HIPAA-related controls are implemented and evidenced. - You assess risk and record exceptions with approvers and business owners.

First 90 days: - Day 30: trace trust boundaries and own the threat model and independent testing

Role summary: As a Senior Security Engineer, you own the security of a shipped product end-to-end—the machine, its operating system image, the software it runs, the cloud service that commands it, and the update path.

What you\'ll own: - The threat model: define and maintain trust boundaries between the device, cloud, operators, update mechanisms, remote support, and suppliers. - Security design reviews: review designs early; keep records of your reviews. - Device identity and key custody: own the threat model, verification priorities, and the platform-side integration with the OS image. - Independent security testing: scope, environment, triage, remediation, and retest evidence. - Finding and fixing weaknesses: triage and fix weaknesses across code, dependencies, device images, and cloud; track findings to closure and report status. - Incident response: drive detection, triage, containment, evidence collection, and post-incident changes with reliability teams. - Customer security reviews: validate statements with evidence (versioned implementations, configurations, and operational records). - Cloud posture: manage identity, access, secrets, and infrastructure-change reviews with cloud provider signals. - Security and privacy controls: ensure HIPAA-related controls are implemented and evidenced. - You assess risk and record exceptions with approvers and business owners.

First 90 days: - Day 30: trace trust boundaries and own the threat model and independent testing