Principal Security Engineer (Data Security)

Role Overview

Principal Security Engineer (Data Security) at Upstart (Full remote). You will define, build, and lead Upstart’s data security program, combining hands-on engineering with program leadership and cross-functional influence.

Key Responsibilities

• Lead the design and execution of Upstart’s data security program, from early foundations to mature, scalable systems.
• Architect and build software solutions (e.g., APIs, services, and internal tools) to enable data protection and governance.
• Drive least-privilege adoption using modern data protection patterns across the organization.
• Establish long-term strategy and accountability for how data is protected.
• Influence senior technical and non-technical stakeholders and coordinate security efforts across multiple teams.

Requirements

• Deep understanding of least-privilege and proven experience applying it at scale.
• Experience leading security programs across multiple teams/functions.
• Strong software engineering background: design and build production-quality systems (APIs, services, internal web applications).
• Experience taking security programs from concept to reality.
• Track record launching new security capabilities/programs from 0 to 1 in complex environments.
• Ability to navigate ambiguity, make sound tradeoffs, and independently drive meaningful change.
• 8+ years of experience and a Bachelor’s degree in Computer Science/Engineering/Mathematics (or equivalent).
• Extensive experience in enterprise/operational security, with deep focus on Data Security and Identity & Access Management.

Nice-to-Haves

• Experience owning/leading Data Security, DLP (Data Loss Prevention), or DSPM (Data Security Posture Management) initiatives.
• Familiarity with modern data protection tooling such as endpoint DLP, data classification, and posture management platforms.
• Experience across diverse data domains (analytics, reporting, business operations, people data).
• Security community contributions (talks, publications, open source).
• Familiarity with compliance frameworks: SOC 1, SOC 2, SOX.
• Interest in long-term senior IC growth, with openness to future people leadership.