Staff Security Engineer

Root is on a mission to unbreak insurance by creating experiences people love at prices they can't believe. We believe that investing in world-class technology will facilitate a new class of insurance products, driving a massive positive impact on the hundreds of millions of drivers who carry auto insurance in the US. Root's Engineering team is committed to building a flexible platform on which our product designers and quantitative scientists can quickly test ideas, deploy them into production, and iterate, with the ultimate objective of a delightful customer experience coupled with effective risk management.

The Opportunity

At Root, we are reimagining insurance by building a smarter, more equitable system from the ground up. As the Staff Security Engineer, you will be the technical visionary driving security strategy across our entire enterprise. You will act as a force multiplier for the Information Security and IT organizations, bridging the gap between high-level business risk and operational execution. In this role, you will define the "paved roads" for security, securing our AI adoption, and elevating our technical maturity to meet the evolving demands of our insurance business and regulatory landscape.

Salary Range: $157,000 - $196,000 (Eligible for competitive bonus and equity offering)

Root is a “work where it works best” company. This means we will support you working in whatever location that works best for you across the US.

How You Will Make an Impact

• Define the architectural standards that protect our employees, customers, and core systems, covering both our cloud environment and our applications, so security is the default state rather than a review at the end.
• Embed security in the development lifecycle: threat-model new product features, review designs before code ships, and build guardrails like secure libraries and CI checks that make the safe path the easy path.
• Decide what good looks like and prove it. Build the metrics and scorecards that show leadership how much risk we removed, and tie security spend to the risks and compliance obligations that matter most.
• Secure our adoption of AI: architectures, threat models, and runtime protections for AI systems in production. Then point the same technology back at our own work, automating vulnerability management, threat detection, and security operations.
• Be the engineer others bring their hard problems to. Explain the why behind a security practice, not just the requirement, and help engineers across the department level up through design reviews and pair sessions.
• Own the security tooling stack, including the build-versus-buy calls, so our controls earn their cost, scale with the company, and satisfy our requirements.
• Take a regular turn in the security engineering team's on-call rotation.

What You Will Need to Succeed

• 10+ years of security experience spanning security operations, product security, infrastructure security, and application security.
• You have set architectural direction: roadmaps, standards, and secure reference patterns that more than one business unit actually followed.
• You have partnered with product and engineering leaders to build security into the development lifecycle, through threat modeling, design review, and secure defaults, instead of bolting it on afterward.
• Deep technical breadth across cloud (AWS) and traditional enterprise security. This is a hands-on role: you build proof-of-concepts to prove a design, and you dig into broken systems yourself when it matters.
• You have run security metrics programs, and the numbers drove prioritization and impact.
• You have designed systems against best practices and regulatory requirements and you know how to pass an audit by design rather than by scrambling before it.
• You have secured AI systems hands-on, from threat modeling to runtime defense, and you have used AI to automate real security work.
• You talk to non-security stakeholders in plain language, build consensus, and influence engineering leadership without being the department of no. You would rather automate a recurring problem than file a ticket about it.
• Bachelor's or Master's in Computer Science, Cybersecurity, or a related technical field, or equivalent practical experience. CISSP is a plus.
• Bonus points for offensive security experience: penetration testing, red teaming, or exploit development. You know how attacks work because you have run them. Extra if that includes attacking AI systems.

As part of Root's interview process, we kindly ask that all candidates be on camera for virtual interviews. This helps us create a more personal and engaging experience for both you and our interviewers. Being on camera is a standard requirement for our process and part of how we assess fit and communication style, so we do require it to move forward with any applicant's candidacy. If you have any concerns, feel free to let us know once you are contacted. We’re happy to talk it through.

Please see our Privacy Notice available HERE for more information on how we process your personal data.

Consistent with the Americans with Disabilities Act (ADA) and the Civil Rights Act of 1964, it is the policy of Root to provide reasonable accommodation when requested by a qualified applicant or candidate with a disability, unless such accommodation would cause an undue hardship for Root. The policy regarding requests for reasonable accommodation applies to all aspects of the hiring process. If reasonable accommodation is needed, please contact [email protected].