Senior Security Software Engineer II, Data Subject Rights and Data Tagging

We're Cruise, a self-driving service designed for the cities we love.

We’re building the world’s most advanced self-driving vehicles to safely connect people to the places, things, and experiences they care about. We believe self-driving vehicles will help save lives, reshape cities, give back time in transit, and restore freedom of movement for many.

In our cars, you’re free to be yourself. It’s the same here at Cruise. We’re creating a culture that values the experiences and contributions of all of the unique individuals who collectively make up Cruise, so that every employee can do their best work. 

Cruise is committed to building a diverse, equitable, and inclusive environment, both in our workplace and in our products. If you are looking to play a part in making a positive impact in the world by advancing the revolutionary work of self-driving cars, come join us. Even if you might not meet every requirement, we strongly encourage you to apply. You might just be the right candidate for us.

The Privacy Engineering & Data Protection team aims to make Cruise a leader in self-driving consumer privacy. Cruise launched its self-driving ridehail service earlier in 2022, and we are quickly scaling; this an opportunity to influence the direction for privacy & data security at a company in its early stages of commercialization!

We are seeking candidates with software engineering chops, with experience supporting data subject access and deletion requests, and excited to be on the cutting edge of self-driving technology. This Security Software Engineer will be working with Privacy Engineers, Security Engineers, and teams across the company to scale core tooling and infrastructure. The focus will be on driving the automation of data subject access, deletion, correction, and opt-in requests.

We’re looking for someone who’s comfortable in uncharted territory as we build unique privacy technologies to maintain user trust. We need your skills and passion to make it happen. Candidates could work in the office (if SF- or Seattle-based) or remotely.

What you’ll be doing

Initial Projects:

• Collaborate with Technical Lead Manager of Privacy Infrastructure to drive build vs buy discussions, and design documentation, for a clear path forward for Cruise to respond to customer and employee access, deletion, correction, and opt-out requests.

• Tackle initial steps to automate aspects of the access & deletion process (building on existing tooling).

• Build the data flows/storage to support deletion of data (in response to data subject access requests) while meeting other regulatory needs.

Long-term Projects:

• Own the roadmap for eventual automation of data subject access, deletion, correction, and opt-in, collaborating with Privacy Legal and Privacy Engineering Services.

• Participating in team’s planning, code reviews, and design discussions leading to continuous improvements in these areas.

• Creating, deploying, and analyzing our infrastructure through infrastructure-as-code tools, (e.g., Terraform).

• Investigating potential risks identified via data discovery/mapping tool, working independently to sample data, explore risks technically, engage data owners, and propose a path forward for managing the risk.

What you must have:

•  Excited to be on the cutting edge of data security & privacy problems. Motivated to protect individuals’ privacy.

• Bachelor's degree in Computer Science or a similar technical field or equivalent practical experience. At least 5 years working experience as a software engineer or software developer or in a related field.

• Proficiency in Python.

• Familiarity with other languages or interest in learning (e.g., Go, C++).

• Demonstrated experience in designing and owning a large system with a data intensive workload.

• Proficiency writing SQL queries & understanding of modern data warehousing.

• Experience with the lifecycle of custom web application development, from requirements gathering to implementation, launch, and ongoing operation.

• Familiarity with full stack web application development—ideally with a modern framework like Django, Flask, or Rails.

• Experience—or at a minimum, interest in—basic front-end development.

• Code maintenance and review experience in one or more general purpose languages.

• Experience building tooling to respond to privacy legal obligations.

• Perseverance and negotiation skills with a track record of achieving good user outcomes.

• Ability to communicate and collaborate across subject areas (e.g. engineering, legal, policy).

• Candidates must have the ab