Staff Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Security Engineer based in the United States.

This is an opportunity to take ownership of security across an innovative AI-powered platform where autonomous agents perform complex tasks involving code, research, and business operations. As Staff Security Engineer, you will strengthen application security, cloud infrastructure, and software delivery practices while addressing emerging threats specific to AI-driven systems. You will tackle challenges such as prompt injection, data exfiltration, unauthorized cross-session access, and vulnerabilities in AI-generated code. Working closely with ITOps, Platform, and Product Engineering teams, you will embed automated security controls into existing development workflows without compromising delivery speed. This is a highly hands-on role combining offensive security, engineering, threat detection, and incident response. You will have significant autonomy to identify risks, drive solutions, and shape security practices in a fast-moving, remote-first environment.

The Staff Security Engineer will define and execute security priorities, taking direct responsibility for improving the organization's security posture and ensuring that critical risks are addressed. Key responsibilities include:

• Establish security priorities and drive remediation efforts through to verified completion.

• Identify application vulnerabilities through code reviews, penetration testing, and specialized red-team exercises targeting AI agents.

• Conduct hands-on security assessments across applications, APIs, cloud infrastructure, and AI-powered workflows.

• Collaborate with ITOps, Platform, and Product Engineering teams to strengthen infrastructure security and integrate security controls into delivery pipelines.

• Design and implement automated security checks within existing development workflows, reducing reliance on slow or blocking manual application security reviews.

• Harden cloud environments through improved access controls, least-privilege permissions, network segmentation, container isolation, and secrets management.

• Build detection capabilities for suspicious user and agent activity, including potential exploitation of AI-specific vulnerabilities.

• Lead security incident response, investigate threats, coordinate remediation, and improve defenses based on lessons learned.

• Develop internal security tooling, automation, and testing frameworks to identify vulnerabilities and validate protective controls.

• Assess emerging threats involving prompt injection, unauthorized data access, data exfiltration, and insecure agent-generated code.

• Take ownership of security outcomes by balancing risk reduction with engineering velocity and communicating decisions clearly to technical teams and leadership.

Requirements

The ideal candidate is a hands-on security engineer with strong offensive security expertise, solid software engineering capabilities, and a deep understanding of the risks associated with AI-powered systems. Required qualifications include:

• Strong background in application security, with the ability to identify exploitable vulnerabilities and recommend effective remediation.

• Practical penetration testing and offensive security experience across web applications, APIs, and cloud infrastructure.

• Strong understanding of infrastructure and cloud security fundamentals, including IAM, network segmentation, container security and isolation, secrets management, and logging.

• Experience implementing security detections and directly managing incident response activities.

• Strong understanding of AI coding agents and LLM-based systems, including their architecture, limitations, vulnerabilities, and potential manipulation techniques.

• Software engineering skills sufficient to develop custom security tools, automation, and testing frameworks.

• Sound technical judgment under pressure, with the ability to evaluate risks against release priorities and make well-reasoned decisions.

• Excellent communication skills, including the ability to explain security risks and remediation strategies to engineers and company leadership.

• Proactive mindset, with the ability to identify security gaps independently and investigate emerging threats without relying on predefined procedures.

Additional qualifications considered an advantage include:

• Experience securing sandboxed or multi-tenant code execution environments.

• Demonstrated red-team, bug bounty, or Capture the Flag (CTF) experience.

• Experience establishing or managing security programs and compliance frameworks such as ISO 27001 or SOC 2 within a small company.

Benefits

• Competitive equity opportunities.

• Significant ownership, autonomy, and responsibility within a small, highly skilled team.

• Opportunity to work at the forefront of AI-powered productivity and autonomous agent technology.

• AI-first working environment with access to tools that expand individual and team capabilities.

• Direct collaboration with experienced engineers, senior leadership, and company founders.

• Flat organizational structure that encourages initiative, independent decision-making, and contributions based on expertise.

• Fully remote-first work environment with global hiring opportunities.

• Access to an in-person coworking hub in Barcelona, with weekly coworking opportunities.

• Opportunity to see the direct impact of your work through daily use of the platform.

How Jobgether works:

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1