Corporate Security Engineer

Legora is redefining how legal work gets done. Our AI-native workspace lets legal professionals move faster, think more clearly, and operate with sharper precision. The Corporate Security Engineer owns the security of Legora’s own environment — the identities, devices, SaaS, and AI tools every employee depends on — the operating root of trust the rest of the company connects through.

Responsibilities

Own the security of Legora’s own environment — the identities, devices, SaaS, and AI tools every employee depends on; Own non-human identity — service accounts, agents, and workloads, with short-lived and secretless credentials and a path to revoke at scale; Set the authorization model for agents — scoped, revocable, and auditable, least-privilege at each MCP call, no token passthrough, delegated authority rather than standing access; Secure how Legora uses AI — govern employee use of LLMs and agents, keep client data on sanctioned paths, and make the safe path the fast one; Advance identity for people — phishing-resistant MFA (passkeys / FIDO2), SSO, SCIM lifecycle, least-privilege / just-in-time access, continuous access evaluation; Raise the bar on SaaS security posture (SSPM) — configurations held to benchmarks, risky OAuth grants, stale admins, shadow SaaS / AI, and config drift surfaced continuously; Own endpoint and device trust — Apple-first fleet on MDM and EDR, zero-trust / conditional access; Own data-protection controls (DLP) across endpoint, SaaS, browser, and AI-egress, run access reviews, surface insider-risk signals; Build controls and guardrails as code (Python + Terraform / IaC) so security scales.

Requirements

4+ years in corporate, enterprise, or IT security, with full ownership of security decisions and scope end to end; A builder first — you write production-grade code (Python at least) and treat controls, automations, and detections as software you own, not tickets you close; AI-first by conviction — you already reach for agents and LLMs (Claude Code and the like) to compress toil, and you have a clear view on where they’re trustworthy and where a human owns the call. Show us something you automated that used to eat your week; Identity-, SaaS-, and AI-centric in how you think about security — the modern attack surface (identity as the new perimeter, the SaaS estate, endpoints, and the AI tools employees use), not network-perimeter or compliance-checklist; Fluent with modern identity — an enterprise IdP (Okta and/or Microsoft Entra ID) and Google Workspace, SSO and SCIM lifecycle, phishing-resistant MFA, and the protocols underneath (SAML, OAuth 2.0, OIDC); Energised by the threat model — you find it motivating, not daunting, that securing an AI company law firms trust with their most sensitive work means well-resourced adversaries and novel attack surface.

Nice to have

Securing AI systems — prompt-injection and exfiltration detection, agent / tool-use telemetry, and the OWASP LLM Top 10; Identity threat detection (ITDR) and SaaS-identity tooling — Okta / Microsoft Entra ID Protection and e.g. Push Security; Non-human identity and secrets — service-account governance, workload identity, and secrets management (e.g. 1Password, HashiCorp Vault); Agent authorization — delegated authority and short-lived, narrowly-scoped tokens (OAuth token exchange / identity chaining), and MCP enterprise-managed authorization; Endpoint at scale — Jamf (Apple) and Intune (Windows), with modern EDR; Security automation and guardrails-as-code — deterministic workflows and SOAR (e.g. Tines, Torq); DLP and insider-risk tooling — modern data-loss prevention and UEBA; SOC 2 / ISO 27001 control implementation and compliance-as-code alongside engineering — GRC owns the certifications, you build and evidence the technical controls; Experience with Okta, Microsoft Entra ID, 1Password, CrowdStrike, Jamf, Lumos, and our AI-native ITSM (Serval).

Benefits

Global collaboration: Partner with teams and clients across Europe, APAC, and North America; Competitive package: Comprehensive salary, benefits, and tools for success; Meaningful work: Your efforts shape how thousands of lawyers use AI daily; In-person environment: Union Square office designed for ambitious builders and company provided lunch daily; Medical, Dental & Vision: Multiple medical plan options through Aetna and Kaiser Permanente, HSA or Healthcare FSA, Dental plans via MetLife, Vision plans via Vision Care; Family Support: Generous parental leave, Free access to Maven Clinic, Dependent Care FSA, Free One Medical membership for employees and dependents; Additional Perks: Pre-tax commuter benefits, Life Insurance + STD/LTD, 401(K) with generous company match, Unlimited PTO, Robust voluntary benefits including identity protection, legal coverage, pet savings programs.