Security Engineer

Role

At Variance, we are teaching machines to make the hardest judgement calls at scale. That means building AI agents for the high-stakes gray-area of risk investigations, fraud, and identity reviews.

We're a small, talent-dense team in San Francisco, with former founders and talent from top AI labs. Our customers include several Fortune 500s, global marketplaces, and regulated financial institutions. If you thrive on extreme ownership, moving fast, and working directly with founders, you'll feel at home here.

We're looking for a Security Engineer to help build that foundation. You'll work across product, infrastructure, and internal systems to make Variance secure by design and help us meet the bar required to deploy AI into critical workflows at the largest companies in the world.

You're a fit if you have:

• 4+ years in security engineering, DevSecOps, application security, or cloud security roles (or equivalent experience).
• Strong hands-on experience in at least one major cloud provider (AWS, GCP, or Azure) and working knowledge of the others.
• Experience building or securing CI/CD pipelines and applying security controls in a developer-friendly way.
• Practical experience with SAST, SCA, DAST, and container scanning, including tuning and validation of findings.
• Ability to perform application and architecture security reviews and communicate findings clearly to engineers.
• Proficiency in at least one programming language used in modern web stacks (Python, Go, TypeScript/JavaScript, Java, or similar).
• Working knowledge of Linux, networking fundamentals, identity and access management, and common web vulnerabilities (OWASP Top 10).
• Strong written communication and documentation skills.

What you'll do

• Harden our cloud infrastructure, internal systems, and product surfaces
• Build security into how we ship: CI/CD, secrets management, access control, dependency hygiene, logging, and monitoring
• Review product and architecture decisions with a security lens, especially around APIs, auth, data access, and tenant isolation
• Partner with engineering to find and fix real vulnerabilities quickly
• Help us design abuse-resistant, trustworthy systems for AI-powered decisioning
• Improve our security posture in ways that matter to Fortune 500 customers
• Support customer security reviews, audits, and technical trust conversations
• Create pragmatic security processes, documentation, and defaults that scale with the company

Preferred background

• Experience in security engineering, application security, cloud security, or DevSecOps
• Strong fundamentals in cloud infrastructure, identity and access management, networking, and web security
• Experience securing modern product teams and development workflows
• Ability to go from finding a problem to helping implement the fix
• Clear written communication and strong judgment
• Familiarity with GCP, infrastructure as code, CI/CD systems, and common security tooling is a plus

Our culture

We believe in ownership, urgency, and craft. We enjoy spirited debate, wild ideas, and building things we're proud of. We're fully in-person in San Francisco.

What we offer

• Competitive salary and meaningful equity
• Platinum-level medical, dental, and vision insurance
• Unlimited PTO, sick leave, and parental leave
• Up to $100 per month in reimbursement for personal health and wellness expenses
• 401(k) plan