Senior Security Engineering Manager, Product Security

The Team

Upstart’s Security Engineering team is passionate about bringing progressive approaches to securing our products, infrastructure, platforms, and enterprise systems. We believe security should empower innovation, move at the speed of business, and embed safety by design into how Upstart builds and operates. Our team’s mission is to protect Upstart’s core product platforms, cloud infrastructure, enterprise systems, customers, and data by partnering deeply with Engineering, Product, Infrastructure, Risk, Compliance, and Security teams to reduce security risk through automation, collaboration, offensive security, and durable security practices.

As the Senior Security Manager for Product Security Engineering at Upstart, you will lead a team responsible for scaling security engineering practices across application security, infrastructure security, offensive security, and product security. You will set priorities, develop team members, and partner with senior engineering and business leaders to shape Upstart’s security engineering strategy, strengthen secure-by-design practices, reduce systemic risk, and improve the security posture of customer-facing products, cloud-native services, internal platforms, APIs, and AI-driven product workflows.

How you’ll make an impact

• Define and lead the Security Engineering roadmap across application security, infrastructure security, offensive security, and product security, aligning priorities with Upstart’s business objectives, engineering strategy, regulatory expectations, and risk posture.
• Manage, coach, and develop a team of security engineers, ensuring clear goals, measurable impact, sustainable execution, effective operating rhythms, and growth opportunities for each team member.
• Partner with Engineering, Product, Infrastructure, Data, Risk, Compliance, and Audit leaders to identify high-priority security risks, align on pragmatic mitigations, and embed security requirements early in planning, design, development, and operations.
• Scale secure-by-design practices across the SDLC, including threat modeling, security architecture reviews, secure coding practices, automated security testing.