Lead Corporate Security Engineer

About the role

The Lead Corporate Security Engineer will be our domain expert for securing our Corporate IT environment. You’ll work closely with colleagues in IT, Business Systems, Security, and Engineering to ensure that our corporate systems are implemented and maintained securely. As a senior member of the team, your impact will be split between building your team, enabling others, and doing hands-on work to mature our systems, processes, and behaviors.

You'll lead the corporate security domain end to end: identity and access governance, endpoint and vulnerability management, detection and response, third-party integration risk, vendor assessment, and SaaS posture. You'll set the standard, own the roadmap, and be accountable for the outcome. IT Engineering runs the platforms day to day and are your closest partners.

Listen to the song we made about it: https://suno.com/s/BiNdRVfLZRJXlfSW

How this role works with IT

Ownership splits by layer, not by system. IT Engineering owns the run; you own the standard and the direction.

• You set the corporate security roadmap. What we secure, in what order, to what bar with buy-in from leadership and XFN stakeholders
• IT engineering owns platform operations. Our SaaS portfolio is administered and integrated by them. You define what those platforms must enforce
• You raise the bar around you. You make your reasoning explicit so that partners make good security calls without you in the room, and you build the tooling and defaults that make the secure path the default path

What you'll own

Identity and access governance

• Own the access model at Suno: the RBAC and entitlement design, least-privilege defaults, and the governance layer in Lumos that enforces them
• Set the standard for what access review, certification, and approval should look like here — then build toward it rather than importing someone else's framework
• Drive access lifecycle automation so joiner/mover/leaver is correct by default and exceptions are visible
• Get ahead of non-human identity: service accounts, agents, and automations are a growing share of what holds access at Suno, and we need a model for them before it's urgent

Endpoint security and vulnerability management

• Own the security standard for our fleet: hardening baseline, compliance signals, device trust, and how endpoint posture feeds access decisions
• Own third-party vulnerability management as a program — coverage, risk-based remediation SLAs, reporting, and the negotiation with teams whose tools are the problem
• Partner with the IT engineer who owns Kandji so the standard becomes deployed policy without degrading how people work

Detection and response

• Own our EDR deployment and maintenance
• Collaborate with Detection and Response on corporate security incidents to closure

Third-party and integration risk

• Own how Suno evaluates third-party access: integration and OAuth review for Slack, Google Workspace and the rest of the portfolio, plus vendor security assessment at purchase and renewal
• Define our risk appetite in practice and make it legible enough that others apply it without you
• Turn recurring decisions into policy, scope guidance, and tooling so the review queue shrinks as the company grows

SaaS security posture

• Build and own the program: the bar for our SaaS applications, the assessment cadence, and the remediation that follows
• Improve tenant-level configuration across the portfolio — SSO and SCIM coverage, MFA and session policy, admin role hygiene, OAuth grant and token management, data sharing defaults

Cross-functional leadership

• Work with IT, Security, Engineering, AI Enablement, and Legal to shape how Suno builds and buys
• Influence the scope of what comes next: how our GRC function plugs in, what we automate versus staff, where the next investment goes
• Mentor and raise the technical bar for people around you, including partners who aren't security specialists

What success looks like

• First 90 days: you've formed your own view of our security posture, built working relationships with the IT engineers the broader Security team, and told us the three things we're wrong about
• First 6 months: a corporate security roadmap exists that IT and the CISO are aligned behind, with the sequencing and the tradeoffs made explicit; the highest-risk items are already moving
• First year: entitlement sprawl and vulnerability backlog are measurably down, detection reflects our real risks, third-party review is fast enough that nobody routes around it, and the standard holds because it's built into tooling and shared judgment rather than into you

What you'll bring

• ~8+ years in corporate/enterprise security or security engineering, including having owned identity, endpoint, or SaaS security as a domain rather than as a set of tickets
• Deep hands-on expertise with a modern IdP and with IGA or access-governance tooling (Lumos, Veza, ConductorOne, Opal, or similar)
• You've designed an entitlement or RBAC model across a large SaaS portfolio and lived with the consequences long enough to know what breaks
• Endpoint security depth in a macOS-primary fleet: MDM-delivered hardening, compliance and device trust, third-party patch and vulnerability management at scale
• Strong command of OAuth, SAML, OIDC, and SCIM, and of the risk model behind third-party integrations
• A track record of setting a security standard that other people applied without you enforcing it — written policy, tooling, defaults, or all three
• Experience influencing engineering and business teams who don't report to you, early enough in their process to change the outcome
• Automation fluency: Python or TypeScript, REST APIs, and a habit of building integrations and internal tooling as a normal part of the job
• Excellent writing and judgment under ambiguity. You can hold a position with an executive and change it when the evidence says to
• A calibrated sense of risk and how to communicate likelihood, impact, and tradeoffs

Helpful, not required: insider risk or DLP programs, zero-trust network access, SOC 2 or ISO program ownership, just-in-time access patterns or identity-as-code, securing AI agent and non-human identity access, prior experience as the first or second security hire at a fast-growing company.

Work Location Policy

This role is expected to work from Suno's NYC or Cambridge, MA office 5 days a week, per Suno's company policy. Full-time employees will receive competitive equity packages, and comprehensive benefits. The actual base salary offered may vary depending on location, skills, qualifications, and experience.

Additional Notes

Applicants must be eligible to work in the US.

Willingness to travel (up to 25%) to lead team members and support offices across Suno locations, with a deliberate cadence in Cambridge and NYC during the first six months.

Perks & Benefits for Full-Time Employees

• Company Equity Package
• 401(k) with 3% Employer Match & Roth 401(k)
• Medical, Dental, & Vision Insurance (PPO w/ HSA & FSA options)
• 11 Paid Holidays + Unlimited PTO & Sick Time
• 16 Weeks of Paid Parental Leave
• Creative Education Stipend
• Generous Commuter Allowance
• In-Office Lunch (5 days per week)