Senior Security Engineer

Role overview Build and lead security practices for an AI gateway and its surrounding development and infrastructure systems. This hands-on generalist role focuses heavily on application security: reviewing a Python codebase, testing APIs and authentication, and working with engineers to address risk throughout design and release. It also covers cloud and IT security, incident response, and software supply-chain protections.

Responsibilities - Review application code, APIs, authentication, and enterprise features; identify and help fix weaknesses such as authorization flaws, injection, secrets exposure, and tenant-isolation failures. - Partner with engineers on threat modeling, secure design, code review, testing, and release, and provide secure-coding guidance. - Integrate static and dynamic analysis, dependency checks, and secrets detection into development workflows. - Test API and AI-specific attack surfaces and harden containers, packages, build workflows, and release systems. - Improve cloud access controls, identity and device security, monitoring, and secure deployment defaults. - Lead vulnerability intake, incident response, remediation, disclosure, and follow-up reviews.

Requirements - Deep application-security experience, including manual review of production Python code and collaboration on remediation. - Strong knowledge of web and API threats, authentication and authorization, SSRF, injection, deserialization, tenant isolation, and secrets management. - Experience with security testing tools such as Semgrep, Bandit, CodeQL, or Burp Suite. - Experience securing containers, CI/CD workflows, packages, dependencies, or cloud environments. - Knowledge of OAuth2, JWT, mTLS, IAM, and high-throughput API authentication. - Practical incident response and vulnerability management experience; relevant degree or equivalent hands-on experience.

Nice to have - Familiarity with SBOMs, signed builds, provenance checks, and tools such as Sigstore, Cosign, Snyk, Grype, or Trivy. - Understanding of prompt injection, model-data exfiltration, tool abuse, and risks specific to LLM applications. - Participation in CTFs, vulnerability research, bug bounties, reverse engineering, or security projects.

Benefits and work setup - Broad ownership across application, infrastructure, and product security, with direct collaboration with engineers. - Listed benefits include competitive pay and health, dental, and vision coverage.