At a Glance
About This Role
Who We Are
Verkada is transforming how organizations protect their people and places with an integrated, privacy-sensitive AI-powered platform that includes solutions for video security, access control, air quality sensors, alarms, intercoms, and visitor management.
We’ve got serious momentum in the market: more than 30,000 customers (including 100+ of the Fortune 500), a $5.8B valuation, more than $1 billion in annualized bookings, and backing from CapitalG, Sequoia Capital, General Catalyst, Felicis Ventures, Next47 and more. Physical AI is one of the most consequential technology shifts of our time, and Verkada is at the center of it.
You can look at all kinds of communities to see our platform’s impact in the world. It's the retailer that uses our agentic AI to deter theft before it happens. The warehouse that uses AI-powered alerts to make sure its team is protected on the floor with proper PPE. The school that’s alerted to a threat in real-time and triggers a lockdown in seconds, not minutes. We’re rapidly scaling this impact: today, more than 2 million Verkada devices are deployed across 170+ countries.
About the role
What You'll Do
- Develop & drive security requirements for the hardware and firmware that goes onto the devices we ship to our customers to improve the security of Verkada’s products and exceed customer expectations.
- Build security tooling to ensure secure development best practices.
- Perform red team/offensive assessments against firmware & devices.
- Triage and recommend solutions for security bugs from tools, third party assessments and bug bounties.
- Develop threat models & attack trees, and participate in security design & code reviews.
- Explore innovative solutions to enable Verkada business instead of “Security says No”.
- Collaborate with the CISO and security team to grow the broader Verkada security program.
- Share your security experience with other teams internally and externally via security conferences and blogs, and help your peer engineers grow their own security reasoning.
What You Bring
- Bachelor of Science in Computer Science, Computer Engineering, or equivalent.
- 8+ years of experience as a security engineer, software engineer, or security consultant.
- Familiarity with security weaknesses, exploits, attacks and mitigations.
- Excellent written & verbal communication & collaborative skills.
- Deep knowledge of Linux-based operating system internals & network protocols.
- Knowledge of hardware security features such as secure boot, TrustZone, disk encryption, or mandatory access control.
- Working cryptography knowledge around primitives, protocols and applications.
US Employee Benefits
Verkada is committed to fostering a workplace environment that prioritizes the holistic health and wellbeing of our employees and their families by offering comprehensive wellness perks, benefits, and resources. Our benefits and perks programs include, but are not limited to:
- Healthcare programs that can be tailored to meet the personal health and financial well-being needs - Premiums are 100% covered for the employee under at least one plan and 80% for family premiums under all plans
- Nationwide medical, vision and dental coverage
- Health Saving Account (HSA) with annual employer contributions and Flexible Spending Account (FSA) with tax saving options
- Expanded mental health support
- Paid parental leave policy & fertility benefits
- Time off to relax and recharge through our paid holidays, firmwide extended holidays, flexible PTO and personal sick time
- Professional development stipend
- Fertility Stipend
- Wellness/fitness benefits
- Healthy lunches provided daily
- Commuter benefits
Additional Information
- We do sponsor and take over sponsorship of employment visas for this role. If we make you an offer, we will make every reasonable effort to get you a visa.
Annual Pay Range
At Verkada, we want to attract and retain the best employees, and compensate them in a way that appropriately and fairly values their individual contribution to the company. With that in mind, we carefully consider a number of factors to determine the appropriate starting pay for an employee, including their primary work location and an assessment of a candidate's skills and experience, as well as market demands and internal parity. A Verkada employee may be eligible for additional forms of compensation, depending on their role, including sales incentives, discretionary bonuses, and/or equity in the company in the form of restricted stock units (RSUs)
Below is the annual on-target earnings (OTE) range for full-time employees for this position, comprised of base compensation and commissions (if applicable).
Verkada Is An Equal Opportunity Employer
As an equal opportunity employer, Verkada is committed to providing employment opportunities to all individuals. All applicants for positions at Verkada will be treated without regard to race, color, ethnicity, religion, sex, gender, gender identity and expression, sexual orientation, national origin, disability, age, marital status, veteran status, pregnancy, or any other basis prohibited by applicable law.
Your application will be handled in accordance with our Candidate Privacy Policy.
Source: Verkada careers · View original posting
About Verkada
Security at Verkada
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
Security Philosophy
- Section 1 — Philosophy and priorities Security enablement over obstruction — "Explore innovative solutions to enable Verkada business instead of ‘Security says No’" (Embedded Linux Security Engineer job posting) [4] Developer and product partnership — "Partner closely with Product, Hardware, and Backend engineering to test and improve the security of Verkada’s products" (Embedded Linux Security Engineer job posting) [4] Security capability building — "Help your peer engineers grow their own security reasoning and knowledge" (Embedded Linux Security Engineer job posting) [4] Risk priorities — Public material emphasizes secure coding, product and firmware security, vulnerability triage, code review, fuzzing, and static analysis.
- No explicit public risk-ranking framework or AppSec mission statement was found. [4] Stated pain points or goals — "Set up security tooling to ensure secure coding best practices" and "Triage and recommend solutions for security bugs from tools, third party assessments and bug bounties" (Embedded Linux Security Engineer job posting) [4].
Security Team
Section 2 — People and structure Org model — Public evidence indicates a security team that partners directly with Product, Hardware, Backend Engineering, and engineering leaders; whether AppSec is centralized, embedded, or hybrid is not explicitly stated. [4] Reporting line — Kyle Randolph is listed as "CISO and VP, Engineering" at Verkada (LinkedIn, accessed); the AppSec team’s direct reporting line is not publicly specified. [3] Leader — Kyle Randolph, CISO and VP, Engineering; LinkedIn: https://www.linkedin.com/in/kylerandolph [3] Leader — Jon Andersen, Federal CISO and Senior Security Engineer; LinkedIn: https://www.linkedin.com/in/securityengineerjon [1] Leader — Benjamin Winston, Security Engineer; LinkedIn: https://www.linkedin.com/in/benjamin-winston-7536b743 [2] Team size estimate — No reliable public AppSec headcount was established. Search query used: "site:linkedin.com Verkada application security security engineer"; result range: at least 3 security-related profiles, but not a validated AppSec team count. [1][2][3] Active AppSec job posting count — No dedicated Application Security Engineer posting was identified in the available results; one security engineering posting with substantial AppSec overlap was found. [4] Common skill and tool patterns — Secure coding, security tooling, vulnerability triage, third-party assessments, bug bounty findings, code reviews and pull requests, Linux system security, fuzzing, network protocols, static analysis, cryptography, secure boot, and embedded security. [4] Public evidence limitations — No public evidence identified for an AppSec-specific organizational chart, formal team charter, or confirmed leadership hierarchy beyond the cited profiles
Key Initiatives
- Section 3 — Programs and workflows Security Champions program Not found — No public Security Champions program, roster, charter, or operating details were identified in the available results.
- Shift-left in CI/CD Publicly stated activities include setting up security tooling for secure coding, participating in code reviews and pull requests, and using static analysis and fuzzing.
- Pre-commit hooks, IDE plugins, CI/CD gates, and developer-facing integration details were not publicly identified. [4] Vulnerability management Intake sources — Security tooling, third-party assessments, and bug bounties are explicitly named. [4] Triage and remediation — The role includes triaging security bugs and recommending solutions. [4] Ticket ownership and SLAs — Public triage SLAs, severity definitions, escalation paths, ticket ownership rules, and remediation deadlines were not identified.
- Secure SDLC ceremonies Code reviews and pull requests are explicitly part of the security workflow.
- Broader secure-SDLC ceremonies, threat modeling, security sign-offs, design reviews, and release gates were not publicly identified. [4] New programs or tool rollouts in the last 6 months The available results do not establish a dated AppSec program or tooling rollout within the six months preceding the stated research date.
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
Interested in this role?
Apply on Verkada's site