Lead Corporate Security Engineer

We're building the world's first creative entertainment platform, where the entire world can feel the joy and fulfillment of making music. Music is for everyone:
Our users include everyone from grandmothers creating songs for their loved ones, to Grammy winners using Suno Studio, our power tool, to make the most popular hits in the world.

Building the future of entertainment requires ambition. The pace is fast, the problems are hard, and the work demands ownership and intensity. For the right people, it’s incredibly rewarding: a chance to shape a new medium, work with a small team that cares deeply about quality, make music, drink too much coffee, and build something that millions of people use to express themselves in ways that were never before possible.

Suno is the fastest growing consumer entertainment company and the leader in AI music. We are backed by leading investors including Bond Capital, Menlo Ventures, Lightspeed Venture Partners, IVP, Forerunner, Union Square Ventures, Alkeon, Quiet, Matrix Partners, Schroders Capital and, NVentures (venture arm of NVIDIA).

The Lead Corporate Security Engineer will be our domain expert for securing our Corporate IT environment. You’ll work closely with colleagues in IT, Business Systems, Security, and Engineering to ensure that our corporate systems are implemented and maintained securely. As a senior member of the team, your impact will be split between building your team, enabling others, and doing hands-on work to mature our systems, processes, and behaviors.

You’ll be building from 0 → 1 in some places and 1 → 10 in others.

What we don't have yet is someone who owns corporate security as a domain — who decides what the bar is, sequences the work to get there, and sees the next problem before it becomes a fire drill.

That's this role. You'll own the corporate security domain end to end: identity and access governance, endpoint and vulnerability management, detection and response, third-party integration risk, vendor assessment, and SaaS posture. You'll set the standard, own the roadmap, and be accountable for the outcome. Our senior IT engineers run the platforms day to day and are your closest partners — you make their work better, not harder.

Ownership splits by layer, not by system. Our senior IT engineers own the run; you own the standard and the direction.

• You own the corporate security roadmap. What we secure, in what order, to what bar. You bring it to IT leadership and the CISO aligned, not for arbitration

• IT engineering owns platform operations. Okta, Lumos, Kandji, and the wider SaaS portfolio are administered and integrated by them. You define what those platforms must enforce

• You raise the bar around you. You make your reasoning explicit so IT engineers make good security calls without you in the room, and you build the tooling and defaults that make the secure path the default path

• You're accountable for the outcome, not just the proposal. You decide, you communicate the tradeoff, and you own what happens next

The people who do well here get their plans stronger by exposing them to the people who run the systems, and they carry the room without needing the org chart to settle it.

Identity and access governance

• Own the access model at Suno: the RBAC and entitlement design, least-privilege defaults, and the governance layer in Lumos that enforces them

• Set the standard for what access review, certification, and approval should look like here — then build toward it rather than importing someone else's framework

• Drive access lifecycle automation so joiner/mover/leaver is correct by default and exceptions are visible

• Get ahead of non-human identity: service accounts, agents,…