How to apply for Senior Security Engineer

About Overstory

Overstory is a climate tech company using real-time satellite data to reduce wildfire risk and improve grid reliability. Their mission directly combats climate change, making it an impactful place to work for those who want to apply security expertise to environmental challenges. The remote-first culture and focus on innovation attract top talent.

About the role

As Senior Security Engineer, you'll own the compliance program (SOC 2, ISO 27001) and drive vulnerability management end-to-end. You'll partner with engineering to embed security into architecture and processes, ensuring secure-by-design systems. This role is critical as Overstory scales its satellite data platform to utilities and insurers.

A typical day

Your day might start with a standup to review vulnerability scan results and prioritize fixes with engineering leads. You could then draft a control narrative for an upcoming SOC 2 audit, followed by a design review for a new microservice to ensure secure-by-default patterns. After lunch, you might conduct a tabletop exercise for incident response and end the day documenting a new security policy.

Who Overstory is looking for

• Has 5+ years in security engineering with hands-on SOC 2/ISO 27001 audit experience, not just theoretical knowledge.
• Deeply experienced in vulnerability management tooling (e.g., Qualys, Nessus) and remediation workflows with engineering teams.
• Fluently works in AWS/GCP and modern SaaS ecosystems, able to design cloud-native security controls.
• Proactive communicator who can lead security input in architecture decisions and influence engineering culture.

Tips for this application

• Highlight specific examples of leading SOC 2 or ISO 27001 compliance programs end-to-end, including audit interactions.
• Showcase vulnerability management metrics you improved (e.g., reduced mean time to remediate) with concrete numbers.
• Mention experience with cloud security in AWS or GCP, especially if you've implemented IaC security scanning or CSPM tools.
• Tailor your resume to emphasize cross-functional collaboration with engineering teams on security-by-design.
• Include a brief cover letter explaining why climate tech and Overstory's mission resonate with you personally.

What to cover in your cover letter

['Your hands-on experience with SOC 2/ISO 27001 audits and vulnerability management programs, with specific outcomes.', "How you've influenced engineering teams to adopt secure design practices without slowing velocity.", "Your passion for using technology to combat climate change and how your skills align with Overstory's mission.", 'Your comfort with remote work and asynchronous communication across time zones.']

Research before applying

• Read Overstory's blog or news articles about their satellite technology and how it helps utilities reduce wildfire risk.
• Understand the regulatory environment for grid reliability and wildfire prevention (e.g., California's SB 901).
• Review their careers page and any public talks by their CTO or engineering leaders to understand their tech stack and culture.
• Check if they have any open source security tools or contributions to understand their engineering practices.

Likely interview topics

Based on the job description, expect questions about:

• Walk me through how you would design a vulnerability management program for a cloud-native startup like Overstory.
• Describe a time you managed a SOC 2 or ISO 27001 audit. What were the biggest challenges and how did you overcome them?
• How do you prioritize security improvements when engineering is shipping fast? Give an example.
• Tell me about a security architecture decision you influenced that prevented a major issue.
• How would you handle a critical vulnerability in a third-party SaaS tool used by the company?

Common mistakes to avoid

• Don't focus only on technical skills without showing compliance and audit experience—this role owns the program.
• Avoid generic answers about 'security best practices' without tying them to Overstory's specific context (cloud, satellite data, utilities).
• Don't underestimate the importance of communication; this role requires influencing engineers and reporting to leadership.