7+ years of experience in backend systems with a focus on security for production services
Strong proficiency in Python and experience managing real-time services
Hands-on experience with applied cryptography techniques
Deep knowledge of cloud security on AWS and/or GCP
Proven track record in leading incident response for production services
Familiarity with confidential computing or attestation technologies is preferred
Ability to communicate effectively with diverse stakeholders
Responsibilities
Design and implement end-to-end encryption for user data
Build infrastructure for confidential computing to ensure sensitive processing is secure
Manage identity and secrets across the technology stack
Oversee supply chain and CI/CD security practices
Establish a detection and response loop for security incidents
Drive vendor and data-handling security measures
Lead compliance efforts from an engineering perspective, ensuring automated evidence production
Contribute to core backend development while maintaining a security focus
Benefits
Health, vision, and dental benefits
Company-sponsored 401(k) plan
Unlimited PTO and sick time
Early stage equity opportunities
Full Job Description
About We're looking for a senior or staff backend engineer with deep security expertise to help build Stream, a new conversational interface. Stream is a self extension that people use to expand their own thinking. We believe thoughts belong only to you and must be private.
You'll own the backend systems that make that privacy real: how user data is encrypted, how keys are managed, how services and people authenticate to our infrastructure, and how we detect and respond to problems. You'll define security at Sandbar, working inside a small backend team on a live production service rather than in a separate security function.
Responsibilities
Design and ship end-to-end encryption for user data, including key management and keeping search and background processing working on encrypted data
Build confidential-computing infrastructure so sensitive processing is isolated and verifiable, including attestation and reproducible builds
Own identity and secrets across the stack: short-lived workload credentials, least-privilege service identities, environment isolation, and auditable privileged access
Own supply chain and CI/CD security
Build the detection and response loop: audit logging, alerting, runbooks, and post-incident reviews that end in engineering changes rather than documents
Drive vendor and data-handling security: AI provider data agreements, third-party integration and OAuth scope review, and data retention and deletion
Lead compliance work (e.g. SOC 2) from the engineering side, with controls enforced by systems and evidence produced automatically
Carry a share of the core backend: build product features on the real-time Python services you secure, and review the team's changes with a security eye
Set direction on secure engineering practice through design reviews, threat models, and clear, minimal guidance that engineers actually follow
Qualifications
7+ years building and operating backend systems, with meaningful time as the engineer accountable for security on a production service
Strong Python and comfort owning a live, real-time service end to end
Hands-on applied cryptography: envelope encryption, authenticated encryption, key hierarchies, and the practical mistakes that break otherwise-correct designs
Deep cloud security experience on AWS and/or GCP: IAM, workload identity federation, KMS, secrets management, audit logging
Experience leading incident response on a production service, from containment through follow-up hardening
Experience with confidential computing or attestation (e.g. Nitro Enclaves, SEV-SNP, TDX, App Attest) strongly preferred
Comfortable with document stores and their access-control models
Able to make tradeoffs explicitly and ship: you know the difference between a control that gates a launch and one that can follow
Communicate precisely with engineers, founders, auditors, and vendors
