Senior Security Engineering Manager, Product Security

About Upstart

At Upstart, we're united by a mission that matters: to radically reduce the cost and complexity of borrowing for all Americans. Every day, we bring creativity, experimentation, and advanced AI to reshape access to credit, helping millions move forward financially with clarity and confidence.

As the leading AI lending marketplace, we partner with banks and credit unions to expand access to affordable credit through technology that's both radically intelligent and deeply human. Our platform runs over one million predictions per borrower using more than 1,800 signals, powering smarter, fairer decisions for millions of customers.

We're proudly digital-first, giving most Upstarters the flexibility to do their best work from wherever they thrive.

The Team

Upstart's Security Engineering team is passionate about bringing progressive approaches to securing our products, infrastructure, platforms, and enterprise systems. We believe security should empower innovation, move at the speed of business, and embed safety by design.

How you'll make an impact

• Define and lead the Security Engineering roadmap across application, infrastructure, offensive, and product security.
• Manage, coach, and develop a team of security engineers, ensuring clear goals and growth opportunities.
• Partner with Engineering, Product, Infrastructure, Data, Risk, and Compliance leaders to identify high-priority security risks and embed security early in the SDLC.
• Scale secure-by-design practices, including threat modeling, automated testing, and vulnerability management.
• Strengthen infrastructure and cloud security through secure architecture, identity controls, and defense-in-depth.
• Build and mature offensive security capabilities, including penetration testing and bug bounty programs.
• Establish metrics and operating models to track risk posture and program health.
• Support response to high-severity security issues and drive durable improvements.

What we're looking for

Minimum requirements

• 8+ years of experience in security engineering, software engineering, infrastructure engineering, offensive security, product security, or related roles.
• 3+ years of experience managing, leading, or formally developing security engineers or technical teams.
• Experience leading security engineering programs in at least two domains: application, infrastructure, offensive, product, or cloud security.
• Experience partnering with cross-functional stakeholders to deliver security initiatives.
• Proficiency with modern application/infrastructure architectures (APIs, web apps, cloud-native services, CI/CD, identity controls).
• Experience defining roadmaps, priorities, and metrics for security programs.

Preferred qualifications

• Experience building or scaling a security engineering function.
• Experience in a regulated environment, fintech, or high-compliance organization.
• Knowledge of AWS, Kubernetes, containers, IaC security, and modern security testing tools (SAST, DAST, SCA).
• Familiarity with security considerations for AI/ML systems or data-intensive applications.
• Strong communication skills for technical and non-technical leadership audiences.
• Relevant certifications (CISSP, CSSLP, CCSP, AWS Security Specialty, GIAC, OSCP).

Position Details

• Location: Remote - US
• Time zone requirements: East/West coast time zones.
• Travel: Regular team onsites (typically 1-2 times per quarter).

Compensation and Benefits

The anticipated base salary range for this position is $190,600 - $263,900 USD. Actual pay depends on geographic location, skills, experience, and education.

We offer a comprehensive benefits package, including:

• Competitive compensation (base, bonus, and annual equity grants).
• Retirement benefits with company match.
• Comprehensive health coverage (medical, dental, vision).
• Paid time off, parental leave, and family-centered benefits.
• Annual wellness and productivity allowances.

Upstart is an Equal Opportunity Employer. If you require reasonable accommodation, please email [email protected].