The RoleJoin Qualitate as our first dedicated security engineer. At 45 people, the security program you build is the one the company will scale on. You9ll harden our cloud environment, build logging, monitoring, and detection, remediate findings from penetration tests, and serve as the security reviewer on design docs for new features and architecture changes. You9ll also lead ISO 27001 from start to finish: scoping, risk assessment, implementing controls, and getting us through the certification audit, with evidence collection automated instead of tracked in spreadsheets. This is a high-ownership role. You9ll be a part of our founding engineering team to define our security architecture and roadmap, and you9ll write and ship production code, not just review it.
Our customers are hedge funds, PE firms, and large enterprises with demanding security requirements, so the systems you secure and the certifications you earn directly shape how fast we grow. The problems are specific to our platform: protecting confidential expert interviews and customer research, securing an AI system that runs thousands of interviews a month, and reaching ISO 27001 without slowing engineering down. You9ll report to our CTO, lead our response when something goes wrong, and partner with our VP of Compliance and Legal on policy, customer security reviews, and our broader compliance program. We9re looking for someone with 4+ years of security engineering experience, including hands-on compliance work, who thrives in fast-moving environments where the surface area is wide and the team is lean.
Who This Role Is For- 4+ years of experience in security engineering. Ideally some of it at a startup or high-growth SaaS company where you secured cloud infrastructure hands-on and also helped build a compliance program.
- Strong Cloud and infrastructure security skills. Experience securing AWS or GCP environments, including IAM, network security, logging and monitoring, secrets management, and encryption. You can read and write infrastructure-as-code.
- Penetration testing rigor. You can contribute to a production code base and address issues raised in a penetration test.
- ISO 27001 experience. You9ve helped take a company through ISO 27001 certification, including scoping the ISMS, running risk assessments, writing the Statement of Applicability, implementing controls, and managing the audit. SOC 2 Type II experience is a plus. [You9ve built the technical controls behind an ISO 27001 or SOC 2 Type II certification, such as access management, logging, vulnerability management, and encryption, and automated evidence collection rather than tracking it in spreadsheets. Familiarity with ISMS scoping, risk assessments, or the Statement of Applicability is a plus.]
- Fluent with AI models and agentic coding tools. You use AI in your daily workflow, understand the security and data governance risks of building with LLMs, and know how to defend against risks like prompt injection and data leakage. This is core to how we work.
- High ownership, low ego. You work independently, communicate proactively, and don9t wait to be told what to build. You9re comfortable making architecture decisions and defending them in code review.
What Sets You Apart- Hands-on experience with security tooling such as SIEM, EDR, CSPM, and vulnerability or container image scanning, and with compliance automation platforms like Vanta or Drata. Bonus if you9ve built reusable guardrails or libraries that make the secure path the easy path for other engineers.
- Experience securing LLM-based applications and agentic systems, including red-teaming AI features for prompt injection, data exfiltration, and tool misuse.
- Experience building technical controls for data segregation and access, ideally in financial services or expert networks where MNPI and client confidentiality matter.
- Security certifications such as ISO 27001 Lead Implementer or Lead Auditor, CCSP, AWS Security Specialty, or OSCP.
- Background in financial services and/or market research.
Compensation & Benefits- Base salary: $160-220K base salary, based on experience.
- Equity: Meaningful early-stage grant with upside tied to company growth.
- Benefits: Health coverage, flexible PTO, paid holidays.
- Location: Full-time, in-person in New York City Mon-Weds, remote Thurs-Fri.
What to Expect Working at Qualitate- Excellence. You9ll be held accountable to an exceptionally high bar for quality and impact.
- High velocity. Fast-paced environment in terms of growth, decision-making, and time to impact.
- High agency. Ownership over how you work, not just what you work on. We hire people we trust to figure it out.
- A builder9s mindset. You9ll create the processes, playbooks, and systems that define how this company scales.
- Shared ambition. A small, early team disrupting the multi-billion dollar market research industry with AI.
- Joy. We work hard and genuinely enjoy working together. Dedication to our work is matched only by our passion for fostering an enjoyable, collaborative work environment.
