Senior Corporate Security Engineer

Toast creates technology to help restaurants and local businesses succeed in a digital world, helping business owners operate, increase sales, engage customers, and keep employees happy.

Toast is seeking a Senior Security Engineer to design, implement, and operate enterprise Data Loss Prevention and Secure Access Service Edge capabilities. The role will reduce data exfiltration risk, enable secure access to web, SaaS, private applications, and cloud services, and improve security coverage.

You will be a senior individual contributor and subject matter expert, within the Enterprise Security team and will closely partner with IT, Network Engineering, Legal, Privacy, Compliance, and application owners. Success requires hands-on engineering, design, operational ownership, and clear risk communication.

A day in the life (Responsibilities)

Data Loss Prevention Engineering

• Own the DLP engineering roadmap and control lifecycle, from requirements and architecture through proof of concept, testing, phased deployment, tuning, operations, and continuous improvement.

• Design and operate controls for sensitive data across managed endpoints, email, web and network channels, SaaS and collaboration applications, cloud environments, and data repositories.

• Build and maintain data discovery and classification logic using sensitive information types, regular expressions, data matching, document fingerprinting, OCR, and machine learning where appropriate.

• Translate requirements into precise policies and response actions with documented exceptions.

• Establish safe policy rollout practices with test cases, pilot groups, change control, user impact analysis, exception review, and measurable acceptance criteria.

• Triage and investigate DLP alerts and incidents, determine root cause and business context, coordinate containment and remediation, and reduce false positives without weakening protection.

• Integrate DLP with SASE services, SIEM/SOAR platforms, MDM, ticketing systems, data classification, data security posture management, and relevant response workflows.

• Define dashboards and metrics for coverage, control effectiveness, detection precision, recurring exfiltration paths, policy exceptions, incident volume, and time to resolution.

Secure Access Service Edge Engineering

• Engineer and operate scalable SASE capabilities for corporate fleet, SaaS, private apps, and cloud environments.

• Configure and optimize core capabilities including secure web gateway, cloud access security broker, zero trust network access, firewall as a service, DNS security, remote browser isolation, DLP, digital experience monitoring, and SD-WAN or SSE integrations.

• Manage traffic steering and connectivity patterns such as endpoint clients, browser or proxy configurations, private application connectors, IPsec or GRE tunnels, and branch or cloud on ramps.

• Lead phased migrations from legacy VPN, proxy, and perimeter security solutions while maintaining service continuity, policy consistency, and a reliable end-user experience.

• Create context-aware access and data protection policies using device posture, application risk, destination, data sensitivity, and session risk signals.

• Develop TLS inspection standards, certificate deployment practices, bypass criteria, privacy safeguards, and documented exception processes in partnership with relevant stakeholders.

• Monitor availability, latency, tunnel and connector health, service edge performance, and policy impact; troubleshoot access and application performance issues across endpoint, network, and cloud layers.

• Design for resilience through regional failover, redundant connectivity, configuration standards, observability, tested recovery procedures and controlled