This listing does not state pay. Across 165 open senior listings that state pay, the middle half runs $177,000 to $261,500 and the median is $222,500.

Listed pay is what employers advertise, not what people are paid.

Senior salaries by state · Check your own pay

How AI is used in this kind of work

Among computer occupations, all other, AI is already used for a large share of the tasks. Measured exposure for computer occupations, all other: 31% (high).

Share of this job’s tasks that AI is already used for at work, from real usage. It is not a forecast of job loss, and a low number means no use seen yet. Source: Anthropic Economic Index.

Check how this applies to your own job

Skills this job asks for

Say which you have and which you want to build. We use it to match you to jobs like this one.

About the job

About Sandbar

Sandbar is an interface company in New York City. We aim to expand human thinking. Our team has built software, ML, hardware, and consumer products across Meta, CTRL-labs, Apple, Peloton, and Equinox.

Our first product is Stream, is private voice ring that extends your thinking. Stream has been featured in WSJ, Bloomberg, Wired, and Time's Best Inventions of the Year.

Join us in creating technology that extends human thinking.

About We’re looking for a senior or staff backend engineer with deep security expertise to help build Stream, a new conversational interface. Stream is a self extension that people use to expand their own thinking. We believe thoughts belong only to you and must be private.

You’ll own the backend systems that make that privacy real: how user data is encrypted, how keys are managed, how services and people authenticate to our infrastructure, and how we detect and respond to problems. You’ll define security at Sandbar, working inside a small backend team on a live production service rather than in a separate security function.

Responsibilities

Design and ship end-to-end encryption for user data, including key management and keeping search and background processing working on encrypted data

Build confidential-computing infrastructure so sensitive processing is isolated and verifiable, including attestation and reproducible builds

Own identity and secrets across the stack: short-lived workload credentials, least-privilege service identities, environment isolation, and auditable privileged access

Own supply chain and CI/CD security

Build the detection and response loop: audit logging, alerting, runbooks, and post-incident reviews that end in engineering changes rather than documents

Drive vendor and data-handling security: AI provider data agreements, third-party integration and OAuth scope review, and data retention and deletion

Lead compliance work (e.g. SOC 2) from the engineering side, with controls enforced by systems and evidence produced automatically

Carry a share of the core backend: build product features on the real-time Python services you secure, and review the team’s changes with a security eye

Set direction on secure engineering practice through design reviews, threat models, and clear, minimal guidance that engineers actually follow

Qualifications

7+ years building and operating backend systems, with meaningful time as the engineer accountable for security on a production service

Strong Python and comfort owning a live, real-time service end to end

Hands-on applied cryptography: envelope encryption, authenticated encryption, key hierarchies, and the practical mistakes that break otherwise-correct designs

Deep cloud security experience on AWS and/or GCP: IAM, workload identity federation, KMS, secrets management, audit logging

Experience leading incident response on a production service, from containment through follow-up hardening

Experience with confidential computing or attestation (e.g. Nitro Enclaves, SEV-SNP, TDX, App Attest) strongly preferred

Comfortable with document stores and their access-control models

Able to make tradeoffs explicitly and ship: you know the difference between a control that gates a launch and one that can follow

Communicate precisely with engineers, founders, auditors, and vendors

Nice to have

iOS security primitives (Secure Enclave, Keychain)

Bluetooth LE device security, firmware signing, or secure pairing

Experience with retrieval systems or LLM infrastructure and their data-flow controls

SOC 2 or ISO 27001 audit experience from the engineering side

FTE Benefits

Health, vision, and dental benefits

Company-sponsored 401(k)

Unlimited PTO and sick time

Early stage equity