Trust and Safety Engineer

Overview

About Spot On — We’re not just building restaurant tech—we’re giving independent restaurants the tools to compete and win. From our award-winning point-of-sale to AI-powered profit tools, everything we do helps operators boost profit, work smarter, and keep their best people. And every solution is backed by real humans who care about helping restaurants succeed.

• Named the #1 Restaurant POS by G2 (Fall 2025), based on ratings from real users
• Rated the top-rated point-of-sale (POS) for restaurants, bars, retail, and small businesses by Capterra users
• Awarded Great Places to Work and Built In’s Best Workplaces for multiple years running

We move fast, care hard, and fight for independent restaurant operators to do what they love, and love doing it. If you’re looking to make an impact with heart and hustle, Spot On is the place for you.

Incident Response & Security Operations

• Lead security incident response efforts, including containment, investigation, root cause analysis, and post-incident reviews. You must be able to organize complex information, initiate response workflows, and confidently lead calls with key stakeholders.
• Manage and monitor endpoint security tools (e.g., Crowd Strike). You must be familiar with modern security requirements for managed devices including laptops, containerized resources, servers, and mobile devices.
• Operate and enhance security monitoring and alerting across cloud, SaaS, endpoint, and identity environments.
• Triage and investigate security alerts related to access misuse, policy violations, suspicious activity, and data exposure.
• Maintain and tune SIEM detections, alert thresholds, and response playbooks.
• Leverage AI tools and technologies to enhance Security Operations

Compliance Engineering & Automation

• Lead the technical requirements to enable automation capabilities to improve time-to-respond, evidence collection, and overall efficacy for visibility and reporting.
• Implement and automate compliance workflows by building integrations that support SOC 2, ISO 27001, PCI DSS, and privacy initiatives.
• Ensure evidence is collected automatically and control performance is continuously validated.
• Translate policies into technical solutions, and annually maintain policies to ensure they remain current with evolving business and regulatory needs.
• Evaluate risk posture and technical requirements for third-party vendors to ensure alignment with internal trust and security standards.
• Identify areas for AI tools and technologies to enhance GRC functions

Data Protection & Risk Management

• Engineer and maintain data protection controls—including encryption, logging, access management, data retention, and proper storage and segregation of PII.
• Conduct periodic user access reviews and implement least-privilege access controls and privileged access workflows.
• Detect and investigate insider risk indicators and anomalous access patterns.
• Secure by Design:
  Partner with product, engineering, and IT teams to embed compliance-by-design principles into new systems and business processes.

Experience & Education

• 3–7 years of experience in security engineering, compliance automation, Security Operations, or GRC-aligned roles in a SaaS or eCommerce environment.
• Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or related field (or equivalent experience).
• Certifications:
  
  CISSP is preferred but not required

Technical Skills

• Hands-on experience implementing and administering endpoint management & security technologies
• Understanding of compliance frameworks including SOC 2, PCI DSS, GDPR, and CCPA.
• Hands-on experience securing cloud platforms and SaaS management tools.
• Proficiency in scripting (Python, Power Shell, Bash)
• Experience leveraging AI tools and technologies to create opportunities for optimization, automation, and intelligent use of data integrations.
• Experience administering a SIEM, alerting, and incident response workflows.
• Experience with compliance automation platforms (e.g., Drata)
• Background in risk scoring or control maturity frameworks.

Soft Skills

• Comfortable leading large calls with key stakeholders and explaining technical controls to…