Senior Corporate Security Engineer

Toast creates technology to help restaurants and local businesses succeed in a digital world, helping business owners operate, increase sales, engage customers, and keep employees happy. Toast is seeking a Senior Security Engineer to design, implement, and operate enterprise Data Loss Prevention and Secure Access Service Edge capabilities. The role will reduce data exfiltration risk, enable secure access to web, SaaS, private applications, and cloud services, and improve security coverage. You will be a senior individual contributor and subject matter expert, within the Enterprise Security team and will closely partner with IT, Network Engineering, Legal, Privacy, Compliance, and application owners. Success requires hands-on engineering, design, operational ownership, and clear risk communication. A day in the life (Responsibilities) Data Loss Prevention Engineering Own the DLP engineering roadmap and control lifecycle, from requirements and architecture through proof of concept, testing, phased deployment, tuning, operations, and continuous improvement. Design and operate controls for sensitive data across managed endpoints, email, web and network channels, SaaS and collaboration applications, cloud environments, and data repositories. Build and maintain data discovery and classification logic using sensitive information types, regular expressions, data matching, document fingerprinting, OCR, and machine learning where appropriate. Translate requirements into precise policies and response actions with documented exceptions. Establish safe policy rollout practices with test cases, pilot groups, change control, user impact analysis, exception review, and measurable acceptance criteria. Triage and investigate DLP alerts and incidents, determine root cause and business context, coordinate containment and remediation, and reduce false positives without weakening protection. Integrate DLP with SASE services, SIEM/SOAR platforms, MDM, ticketing systems, data classification, data security posture management, and relevant response workflows. Define dashboards and metrics for coverage, control effectiveness, detection precision, recurring exfiltration paths, policy exceptions, incident volume, and time to resolution. Secure Access Service Edge Engineering Engineer and operate scalable SASE capabilities for corporate fleet, SaaS, private apps, and cloud environments. Configure and optimize core capabilities including secure web gateway, cloud access security broker, zero trust network access, firewall as a service, DNS security, remote browser isolation, DLP, digital experience monitoring, and SD-WAN or SSE integrations. Manage traffic steering and connectivity patterns such as endpoint clients, browser or proxy configurations, private application connectors, IPsec or GRE tunnels, and branch or cloud on ramps. Lead phased migrations from legacy VPN, proxy, and perimeter security solutions while maintaining service continuity, policy consistency, and a reliable end-user experience. Create context-aware access and data protection policies using device posture, application risk, destination, data sensitivity, and session risk signals. Develop TLS inspection standards, certificate deployment practices, bypass criteria, privacy safeguards, and documented exception processes in partnership with relevant stakeholders. Monitor availability, latency, tunnel and connector health, service edge performance, and policy impact; troubleshoot access and application performance issues across endpoint, network, and cloud layers. Design for resilience through regional failover, redundant connectivity, configuration standards, observability, tested recovery procedures and controlled automation. What you'll need to thrive (Requirements) Education: Bachelor's degree in Engineering, Cybersecurity, or equivalent practical experience. Experience: 7+ years of experience, including substantial hands-on responsibility in enterprise security engineering environments. DLP engineering: Ability to architect, deploy, tune, and operate at least one major enterprise DLP platform, with strong knowledge of data discovery, classification, content inspection, endpoint controls, cloud and SaaS coverage, policy actions, exceptions, investigations, and metrics. SASE engineering: Ability to design, implement, migrate, and operate at least one major SASE/SSE platform. Practical knowledge of SWG, CASB, ZTNA, FWaaS, traffic steering, TLS inspection, connectors, and performance. Vulnerability management: Experience assessing, prioritizing, tracking, and validating remediations Developer and automation mindset: skills in Python, or a comparable language. Working knowledge with REST APIs, automation platforms, and AI-assisted dev tools such as Claude, Copilot, Codex or similar. Communication: Excellent communication skills and sound judgment. Preferred (Bonus) Skills Education: Master's in Computer Science, Cybersecurity, Information Security, or a related discipline. Security operations integrations: Experience integrating security controls with platforms such as Splunk, Datadog, Torq, Palo Alto Cortex XSOAR, or comparable observability and automation tooling. AI security and automation: Experience applying AI to improve security detection, policy engineering, investigation, or operational efficiency, and familiarity with controls for enterprise generative AI usage. Security frameworks: Working knowledge of NIST Cybersecurity Framework, CIS Controls, and zero trust principles, with the ability to translate requirements into operational controls. Governance platforms: Familiarity with ServiceNow GRC, Optro, or similar governance platforms. Certifications: CISSP, CISM, CCSP, Security+, Network+, cloud security, or SASE/DLP vendor certifications. AI at Toast At Toast, one of our company values is that we're hungry to build and learn. We believe learning new AI tools empowers us to build for our customers faster, more independently, and with higher