Harvey is seeking a Staff Corporate Security Engineer to secure the company's IT and business systems as it grows. This hybrid role sits in Harvey's corporate security function and focuses on enterprise integrations, SaaS security, data flows, and eDiscovery workflows, balancing risk with user experience and validating assumptions through threat modeling and real-world testing. Responsibilities include designing, implementing, and governing security controls for cross-application data flows, API integrations, OAuth connections, and third-party SaaS platforms; owning the security review lifecycle for new integrations and automating posture monitoring; building and operating eDiscovery and legal hold programs in collaboration with Legal and Compliance; providing security oversight across the SaaS application lifecycle; supporting endpoint security policies and vulnerability management; and developing scripts and integrations to surface signals from SaaS and business applications with the Detection & Response team. Qualifications include experience securing enterprise SaaS environments with API token management, OAuth governance, and data-flow risk; familiarity with authentication/authorization standards (SAML, OIDC, SCIM, X.509); experience with eDiscovery and legal holds and tools such as Purview, Vault, Relativity, Everlaw; strong software engineering fundamentals (Python and/or Go) and experience building SaaS API integrations; infrastructure-as-code experience (Terraform or Pulumi); ability to identify risks and communicate them to diverse stakeholders; familiarity with e

Harvey is seeking a Staff Corporate Security Engineer to secure the company's IT and business systems as it grows. This hybrid role sits in Harvey's corporate security function and focuses on enterprise integrations, SaaS security, data flows, and eDiscovery workflows, balancing risk with user experience and validating assumptions through threat modeling and real-world testing. Responsibilities include designing, implementing, and governing security controls for cross-application data flows, API integrations, OAuth connections, and third-party SaaS platforms; owning the security review lifecycle for new integrations and automating posture monitoring; building and operating eDiscovery and legal hold programs in collaboration with Legal and Compliance; providing security oversight across the SaaS application lifecycle; supporting endpoint security policies and vulnerability management; and developing scripts and integrations to surface signals from SaaS and business applications with the Detection & Response team. Qualifications include experience securing enterprise SaaS environments with API token management, OAuth governance, and data-flow risk; familiarity with authentication/authorization standards (SAML, OIDC, SCIM, X.509); experience with eDiscovery and legal holds and tools such as Purview, Vault, Relativity, Everlaw; strong software engineering fundamentals (Python and/or Go) and experience building SaaS API integrations; infrastructure-as-code experience (Terraform or Pulumi); ability to identify risks and communicate them to diverse stakeholders; familiarity with e