Principal Compliance & Security Engineer
Principal-level individual contributor who owns both security engineering (threat modeling, vulnerability management, incident response) and compliance (SOC 2, PCI DSS, COPPA, GDPR/CCPA control frameworks) across MrBeast's ventures including Step, Feastables, and the media business. Hands-on cloud security work on AWS/GCP, hybrid from San Mateo, CA (~3 days/week in office).
- Compensation
- Not disclosed
- Location
- San Mateo, CA
- Work setup
- Hybrid
- Seniority
- Principal
- Employment
- Not specified
- Experience
- 15+ years
- Category
- Security
- Posted
Skills
Must have
- ~15 years of combined security engineering and compliance experience
- Proven ownership of PCI DSS and SOC 2 in production, from control design through successful audit
- Strong cloud security experience (AWS/GCP)
- Application security experience
- Threat modeling experience
- Incident response experience
- Ability to read and reason about code
- Working knowledge of privacy and minor-protection regulation (COPPA, GDPR, CCPA) and how it maps to technical controls
- AI-native: already using AI daily and bringing it into security work (automation, evidence pipelines)
- Able to assess and communicate risk tradeoffs to business leaders in plain terms
Nice to have
- Fintech or payments experience (money movement, KYC)
- Security automation and infrastructure-as-code (Terraform, policy-as-code)
- Relevant certifications (CISSP, CCSP, OSCP)
- Experience standing up a security or compliance function from an early stage
Full description
About Us
Beast Industries is a multifaceted media and entertainment company founded by Jimmy Donaldson, popularly known as MrBeast, the most watched person in the world. Renowned for revolutionizing digital content creation, Beast Industries encompasses a diverse portfolio of ventures that extend far beyond its origins on YouTube. With a mission to entertain, inspire, and create significant social impact, Beast Industries operates across various domains including digital media, philanthropy, consumer products, and innovative business initiatives. At Beast Industries, we believe in the transformative power of digital media and its potential to entertain, educate, and effect positive change. Our commitment to innovation, creativity, and philanthropy drives us to explore new frontiers, create unforgettable experiences, and build a legacy that inspires future generations.
Principal Compliance & Security EngineerThe Opportunity
We're doing an AI-first engineering rebuild for a company that already has an audience of 100M+ people. This is a zero-to-one build with no legacy constraints, which means you get to stand up the security and compliance foundation correctly from the start. The stakes here are concrete: Step handles money and serves minors, Feastables carries consumer and supply-chain data, and the media business ships fast and constantly. You're here to make regulated products shippable without slowing them down.
The Mandate
You'll be a single principal-level IC bridging two disciplines that usually live on separate teams: security engineering (threat modeling, vulnerability management, hardening, incident response) and compliance engineering (control design, audit evidence, framework mapping across SOC 2, PCI DSS, COPPA, and privacy law). That means:
- Own the security architecture and the technical compliance posture across Step, Feastables, and the media org.
- Build one control framework, with each control mapped to the regulation it satisfies (PCI DSS, COPPA, GDPR/CCPA, SOC 2).
- Make compliance continuous by automating evidence collection and control monitoring, not a once-a-year scramble.
What You'll Do
- Set the security standards other engineers build against across cloud infrastructure, applications, and data systems.
- Lead threat modeling and security reviews for high-risk products, especially Step's payment and account systems and anything touching minors' data.
- Run the vulnerability management program and drive remediation to closure with the teams that own the systems.
- Build and own incident response: detection, playbooks, escalation, post-incident review, and breach-notification readiness.
- Act as technical lead during PCI DSS and SOC 2 audits, and represent Beast with auditors, regulators, and partners.