Security Engineer

• Build and own XMTP’s comprehensive security strategy across internal, cyber, travel, and executive domains.
• Establish a layered defense model aligned with our mission: *secure the world’s freedom to communicate.*
• Create high-clarity frameworks for risk, readiness, response, and prioritization.
• Present strategy and risk assessments to leadership, investors, and external partners.
• Define and enforce device, tooling, authentication, and access standards.
• Oversee MDM, hardware key enforcement, internal permissions, and secrets management.
• Implement systems that assume compromise and minimize blast radius.
• Own security elements of onboarding and offboarding while partnering with our Ops team for execution.
• Lead the digital defense of XMTP’s engineering, infrastructure, cloud systems, and protocol interfaces.
• Own threat detection, incident response, monitoring, and vulnerability management.
• Partner with Engineering to harden production environments, CI/CD pipelines, and secure key material.
• Ensure best-in-class security tooling across endpoints, authentication, and encryption.
• Architect the travel security program for staff attending conferences, hackathons, and high-risk environments.
• Build protections against proximity attacks, in-person targeting, device cloning, and social engineering.
• Standardize travel kits (Faraday protection, privacy screens, secure bags) and protocols.
• Train employees for situational awareness and safe operating procedures on the ground.
• Develop protocols for device hardening, travel safety, communications security, and identity protection for high-profile individuals.
• Establish response plans for impersonation, targeted phishing, and other executive-focused threats.
• Partner with Brand and People Operations to embed security into XMTP’s identity - swag, onboarding, systems, and storytelling.
• Ensure every internal and external interaction signals XMTP’s security-first culture.
• Drive company-wide education that raises awareness and reinforces safe practices.
• Select and manage external security firms, penetration testers, and threat intelligence partners.
• Own contracts, performance, budgets, and strategic evaluations.
• Establish relationships with industry experts and security communities.
• Maintain all security documentation:
• Incident response
• Travel protocols
• Device standards
• Engineering security guidelines
• Internal training
• Run tabletop exercises and simulations to test readiness.

Head of Security

Security Engineer

Senior/Staff Security Engineer – Corporate Security

Principal Security Engineer, Application Security

Senior Security Engineer, GTM Partnership