Founding Security Engineer

Founding Security Engineer — AI Scale-Up | New York

The following information provides an overview of the skills, qualities, and qualifications needed for this role.

A venture-backed AI company in New York is hiring its first dedicated security engineer to build the function from the ground up, spanning application security and cloud security.

This is a hands-on role at a company with strong product-market fit, at the point where enterprise customers are starting to ask harder questions than the current setup was designed to answer. You'd own the programme end to end rather than inherit someone else's backlog.

What you'll own

• Application security across the product: threat modelling, secure design reviews, secure code review, and working with engineers to fix what you find
• Cloud and infrastructure security: IAM and least privilege, network segmentation, secrets management, container and Kubernetes security, and cloud posture across AWS or GCP
• Security tooling in CI/CD: SAST, SCA, dependency and secrets scanning, integrated so the secure path is the easy path rather than a gate engineers route around
• Vulnerability management end to end, from discovery and prioritisation through remediation and verification
• The security roadmap — identifying where the real risk sits, sequencing the work, and making the case for what gets built and when
• Partnering with engineering on secure-by-default patterns, and with the business on customer security reviews and compliance groundwork
• Setting the direction for how the function grows, including where to hire next

What you'll need

• Hands-on security engineering experience spanning application and cloud security, with real depth in at least one
• Strong software engineering fundamentals — you write and review production code rather than only specifying fixes
• Experience building security tooling and automation, not just operating what vendors sell you
• Working knowledge of modern cloud environments, containerised workloads and infrastructure as code
• The judgment to tell a meaningful control from compliance theatre, and to accept managed risk when the alternative slows the business for no real gain
• Comfort operating without a playbook, and the credibility to influence engineers you have no authority over

Nice to have

• Prior experience as a first or early security hire
• AI and LLM security exposure: prompt injection, agent tool access, model supply chain
• Offensive security background that informs how you build
• SOC 2 or ISO 27001 experience from the engineering side rather than the audit side

The environment

Small, technically dense team with short feedback loops. Security is treated as something that helps the business ship, not something that slows it down.

Based in New York. xhyhwjd

If this sounds like you, get in touch.