Remote security engineer jobs

Security engineering is one of the more remote-friendly corners of tech: Netflix lists every open security req as ‘Remote, United States’ with a $400,000–$680,000 band, Coinbase and CrowdStrike’s Product Security team are remote-first, 16 of Microsoft’s 41 US security reqs are fully remote, and OpenAI, Anthropic and Cloudflare each tag specific teams (infrastructure security, threat intel, offensive security, security platform) as US-remote. The programs below are the ones where remote is a real option, not an exception; Amazon (five days in office), Meta, Google and Apple (hybrid, about three days) and Datadog (one req remote in five states) are not.

7 of 12 ranked programs match · Last verified October 10, 2026 · See the full Security Engineer List →

Security engineers protect OpenAI’s research and production environments, from bare-metal hardware and firmware through Kubernetes, multi-cloud and CI/CD to model weights and user data. Infrastructure security, detection and response, application security and agentic-AI security dominate the reqs, and the org describes itself as ‘technical in what we build but operational in how we do our work’.

Base salary

$266k–$445k

Locations

SF · Seattle · NYC · DC · remote

Work setup

Hybrid, 3 days a week in office on Application Security (relocation offered); Infrastructure Security, Threat Intel Engineering and some D&R, Agent Security and Host Assurance reqs are US-remote

Experience

Experienced hires: the core Security Engineer reqs state no year count but expect hands-on AppSec, detection-and-response or infrastructure-security depth (secure coding, Kubernetes, multi-cloud, threat modeling); Forward Deployed Security Engineer asks 5+ years and Staff Security Reliability 10+. No entry-level or new-grad path.

Worth knowing: In 2026 OpenAI disclosed two supply-chain incidents that forced code-signing certificate rotation: a malicious Axios release ran in its macOS signing workflow on March 31, and the TanStack ‘Mini Shai-Hulud’ campaign breached two employee devices and some internal repos (disclosed May 14). OpenAI reported no customer data or production systems affected.

26 Security-department reqs on the Ashby board (of 815), about 14 of them security-engineering ICs — Application Security (SF, Seattle, NYC), Detection & Response, Agent Security, Infrastructure Security, Host Assurance, Security Observability, Threat Intel Engineering, and a Forward Deployed Security Engineer in DC

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full OpenAI Security page →

Security engineers secure the systems that train, serve and increasingly are Claude: identity and secrets, supply-chain and CI/CD hardening, sandboxing, firmware and BMC security, detection and response, red teaming, and AppSec for agentic and code-execution systems. Reqs skew Senior and Staff+, teams build LLM-driven tooling for their own work, and several reqs are remote-friendly, which is unusual for a lab this size.

Base salary

$300k–$405k

Locations

SF · NYC · Seattle · DC

Work setup

Office-centered hybrid — all staff are expected in an office at least 25% of the time and most security reqs are tagged on-site; Offensive Security, Threat Intel and Staff+ Application Security reqs are remote-friendly. Detection & Response includes an on-call rotation.

Experience

Experienced hires, skewing senior: Detection & Response asks 3+ years of software engineering or 5+ years of detection engineering and incident response; Offensive Security 5+ years of red teaming; Senior Software Security 5+; Staff+ reqs 7–8+. No entry-level or new-grad security engineer path.

Worth knowing: Anthropic’s AppSec team says Claude is its primary tool — it drives static analysis, drafts vulnerability fixes as pull requests and does first-line bug bounty triage — and Project Glasswing, launched in April 2026 with Claude Mythos Preview, reported over 10,000 high- or critical-severity vulnerabilities found with partners by May.

51 Security-department reqs on the Greenhouse board (of 645), about 17 of them US security-engineering ICs — Detection & Response, Offensive Security, Threat Intel, Senior and Staff+ Software Security, Staff+ Application Security, Platform and Hardware Security (OpenBMC, OS, firmware), Security Fusion Platform and GRC Platform — across SF, NYC, Seattle and DC

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Anthropic Security page →

Security engineers here do offensive work and product security on Windows, Azure and M365 — pen testing, red teaming, code audit and mitigation design — plus SOC and detection engineering for Microsoft’s internal estate. Reqs skew to offensive security, security research and security operations rather than generalist AppSec, and 2026 postings stress AI and agentic tooling. Several cleared reqs sit in Reston and Redmond.

Base salary

$102k–$202k

Locations

Redmond · Reston · Atlanta · Pittsburgh · US remote

Work setup

Mixed by req — 23 of 41 list ‘3 days/week in-office’, 16 list ‘0 days/week in-office – remote’, and 2 are fully on-site cleared work; company policy sets 3 days a week for staff within 50 miles of an office (Puget Sound from February 2026)

Experience

Security Engineer II (IC3): bachelor’s in CS, math, statistics or related plus 2+ years in security, or master’s plus 1+ year, or equivalent experience. Senior (IC4): bachelor’s plus 4+ years. Principal (IC5): bachelor’s plus 6+ years. Entry level: the IC2 Red Team req asks only for a bachelor’s or equivalent experience. Some reqs require government clearances.

Worth knowing: Microsoft’s July 10, 2026 Secure Future Initiative report says its multi-agent system for assessing cloud services had over 90% of findings confirmed by security engineers, and a 2026 Windows Security req asks hires to ‘build reusable agents and tools’ to speed up security reviews.

41 US reqs in Microsoft’s ‘Security Engineering’ profession as of Oct 10, 2026 (Security Research 19, Penetration Testing 8, Security Operations Engineering 8, Security Assurance 6), plus more security-titled reqs filed under Software and Hardware Engineering; 29 list Redmond, the rest Reston VA, Atlanta, Pittsburgh, Reno, Mountain View, Maryland or generic US; newest posted Oct 9, 2026

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Microsoft Security page →

Netflix security engineers work in a small, senior, autonomy-heavy org, mostly on cloud security and IAM across AWS and GCP, platform and workload identity, workforce security (including GenAI tools), Open Connect CDN protocol security and security analytics. Hires are expected to build tooling and drive work independently under the culture memo’s ‘context not control’ model. There is almost no entry-level path.

Base salary

$400k–$680k

Locations

US remote (hubs in Los Gatos and LA)

Work setup

Remote — every open security engineering req lists ‘Remote, United States’ and the posting text states no office-day requirement

Experience

Senior-heavy: open security engineering reqs are L5 and L6 (staff level), with no entry-level security req. The L5 cloud security req asks for deep AWS/GCP IAM and cloud security architecture experience and strong scripting; the L6 Open Connect req asks for applied cryptography and protocol (TLS, QUIC) expertise.

Worth knowing: Netflix security reqs are all-cash: the L5 security engineer band is posted at $400,000–$680,000 and L6 at $499,000–$900,000, with no bonus and a choice between salary and stock options — the highest posted security pay on this list.

About 8 US security-engineering reqs open on Oct 10, 2026, all listed ‘Remote, United States’: Security Engineer L5 (Cloud Architecture, Tooling and Security), Security Engineer 5 (IAM), Security Analytics Engineer L5, Security Software Engineer L6 (Security Protocols & Foundations, Open Connect), Software Engineer L6 (Platform Security), two Business Security Partner L5 reqs and a Support Solutions Engineer L5 (Security, Privacy and Assurance); newest posted Sep 23, 2026

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Netflix Security page →

Coinbase security engineers protect custody and customer assets: threat intelligence and detection engineering, cryptographic and key-management platforms (MPC, KMS, secrets, certificates), plus cloud, application and offensive-security work on the Web3 side. The open US roles are senior, remote and Go/Python/Rust-heavy, with explicit generative-AI expectations in the postings.

Base salary

$180k–$212k

Locations

Remote US

Work setup

Remote-first, with quarterly in-person ‘surges’

Experience

Threat Intelligence Platform Engineer asks 2+ years building threat-intel platforms or security data pipelines; Senior Threat Intelligence 5+ years in threat intel, incident response or investigations; the security-platform SWE reqs 5+ years plus applied cryptography or KMS/HSM. No entry-level or new-grad security path.

Worth knowing: On May 5, 2026 Coinbase cut about 14% of staff (about 700 people) in a restructuring toward AI-assisted small teams, and the live board now holds only four US-remote security-engineering reqs — yet those seats carry the highest reported total comp on this list.

Four US-remote security-engineering reqs open on the Greenhouse board — Senior Threat Intelligence Engineer, Threat Intelligence Platform Engineer, and Senior Software Engineers for Secrets Management and Certificate Management; the only Product Security Engineer req is Canada-only and the Security Platform Engineer reqs are India or Israel

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Coinbase Security page →

Cloudflare security engineers work as ‘Customer Zero’ for the company’s own network and products: product security and bug bounty triage with LLM-based automation, AI and agent red teaming, insider threat, IAM, and Cloudforce One threat intelligence and vulnerability defense. A separate group builds distributed secrets and key-management platforms in Go and Python. The org was shaped by the November 2023 nation-state intrusion and ‘Code Red’ remediation, which rotated 5,000+ credentials.

Base salary

$166k–$208k

Locations

Austin hub · NYC · DC · distributed US

Work setup

Hybrid (in-office days not stated; the IAM role is ‘hybrid from Austin’); Security Platform engineering reqs are distributed across US cities and US-remote

Experience

Mid-to-senior: AI Security Research & Red Team asks 4+ years in offensive or application security, Product Security 5+ years of AppSec in large-scale cloud or SaaS, Insider Threat 5+ years, Cloudforce One engineers 5 years building large-scale software. No entry-level or new-grad security engineer path.

Worth knowing: Cloudflare announced a roughly 20% workforce cut (more than 1,100 jobs) on May 7, 2026 to move to an ‘agentic AI-first’ model — yet by October its board still lists 15 Security-department reqs, including new AI-security roles such as AI Security Research & Red Team Engineer (published Aug 10, 2026).

15 Security-department reqs on the Greenhouse board (of 424), about 10 of them US security-engineering ICs mostly in Austin — Product Security, IAM Security, Insider Threat, Senior Threat Intelligence, AI Security Research & Red Team (Austin, NYC), GRC Engineer and Cloudforce One threat-intel and vulnerability-defense engineers — plus about four security-platform and detection reqs in Engineering

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Cloudflare Security page →

Internal security engineers at CrowdStrike sit mainly in Product Security, hardening the Falcon platform’s code, software supply chain and open-source footprint, running threat models, secure code review and bug-bounty response, and building automation to triage vulnerabilities. AppSec, supply chain and vulnerability intelligence dominate the open US seats, and most of the company’s other ‘security’ reqs are product engineering, services or sales — so the internal ladder is narrow but fully remote.

Base salary

$120k–$180k

Locations

Remote US · NYC (SIEM)

Work setup

Remote-first for Product Security; hybrid (about 2 days a week) for the NYC and Sunnyvale reqs

Experience

Engineer II (Software Assurance) lists no explicit years — experience implementing and monitoring software security systems, GitHub and SCA tooling, Python or Go scripting — and is the closest thing to an entry path; Vulnerability Intelligence asks 5–7+ years, Senior AppSec 8+. No formal new-grad security track.

Worth knowing: CrowdStrike’s own posting says Product Security ‘breaks the mold of traditional internal security’ by focusing on active threats to its products; the Sep 30, 2026 Engineer II req centers on securing GitHub orgs, secret scanning and malicious-package monitoring, ten months after the company fired an insider (Nov 2025) who passed internal screenshots to Scattered Lapsus$ Hunters.

Four internal Product Security reqs open in the US, all remote — Engineer II Software Assurance (posted about Sep 30, 2026), Senior Application Security, Product Security Engineer Vulnerability Intelligence, and Software Engineer Security Automation — plus a hybrid NYC Security Engineer III for the Next-Gen SIEM product; no internal detection-and-response, cloud security or offensive reqs

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full CrowdStrike Security page →

Common questions

Netflix (all open security reqs are remote), Coinbase (remote-first with quarterly in-person ‘surges’), CrowdStrike (Product Security is remote-first), Microsoft (16 of 41 US security reqs list zero in-office days), OpenAI (Infrastructure Security, Threat Intel Engineering and some Detection & Response, Agent Security and Host Assurance reqs), Anthropic (Offensive Security, Threat Intel and Staff+ Application Security) and Cloudflare (Security Platform engineering, distributed across US cities).

Not on this list. Netflix’s remote L5 band is the highest posted anywhere ($400,000–$680,000), Coinbase’s remote reqs post $180,370–$212,200 with the highest reported total compensation after Netflix, and Microsoft and Amazon post the same band on remote and in-office reqs (Amazon’s virtual Compliance Penetration Testing req carries the Seattle $159,300–$202,400 range). Companies that adjust by location, such as Microsoft, Coinbase and Cloudflare, do so by your state or metro rather than by remote status.

Detection and response, threat intelligence, security platform and tooling, and cloud and IAM security — the work that runs on cloud infrastructure rather than hardware. OpenAI’s Infrastructure Security and Threat Intel reqs, Anthropic’s Threat Intel and Offensive Security, Coinbase’s threat intelligence and secrets-management seats, Cloudflare’s Security Platform team and Netflix’s cloud security and IAM reqs are all remote. Hardware, silicon and on-device security (Apple, Google) and cleared government work (Microsoft, Amazon) are the least.

Land the offer, not just the interview.

Practice security engineering interview questions, mock interview with peers, and learn the frameworks hiring managers actually score you on.

Take the Security course Practice interview questions

Remote security engineer jobs

Common questions

Browse security engineer jobs

Salary & hiring by company

Interview guides

More job lists

Land the offer, not just the interview.

Follow Us