7+ years of experience in application, product, cloud, or infrastructure security with hands-on security engineering expertise.
Strong software engineering skills for reading, writing, and reviewing production code.
Deep understanding of application and API security, authentication, authorization, and cloud security.
Experience in designing scalable security architecture and secure-by-default controls.
Knowledge of AI security risks, including prompt injection and sensitive-data leakage.
Proficiency in AWS security services and application security tools like CodeQL and Burp Suite.
Strong communication skills to translate security risks into engineering decisions.
Responsibilities
Define and drive company-wide security strategy across applications, cloud infrastructure, and AI systems.
Lead security architecture reviews, threat modeling, and security testing in collaboration with engineering teams.
Implement security guardrails for AI applications and integrations, focusing on identity and data access.
Enhance security across cloud platforms and software supply chains through scalable controls and automation.
Oversee vulnerability management and incident response, providing leadership during security incidents.
Collaborate with various teams on security architecture, policies, and compliance programs.
Cultivate a security culture within the engineering organization through training and mentorship.
Benefits
Fully remote work environment with home office setup allowance.
Unlimited vacation policy promoting meaningful time off.
Comprehensive health and wellness benefits package.
401(k) plan with employer contributions.
Opportunity to work with passionate colleagues in a supportive culture.
Full Job Description
What You Will Do
Security strategy and leadership: Help define and drive company-wide security strategy across applications, cloud infrastructure, and AI systems. Identify our highest-impact risks and lead cross-functional initiatives to address them.
Application and product security: Lead security architecture reviews, threat modeling, code reviews, and security testing. Partner with engineering teams to build security into the SDLC and eliminate classes of vulnerabilities through secure-by-default patterns and guardrails.
AI and agentic security: Define and implement security guardrails for LLM-powered applications, AI agents, coding assistants, and MCP/tool integrations, including identity, permissions, data access, secrets, sandboxing, and human approval boundaries.
Cloud and infrastructure security: Improve security across AWS/GCP, containers, CI/CD, identity and access management, and the software supply chain through scalable controls and automation.
Vulnerability management and incident response: Improve how we discover, prioritize, remediate, and detect security issues, and provide technical leadership during significant security incidents.
Company-wide security: Partner with Engineering, Infrastructure, IT, Legal, and other teams on security architecture, policies, compliance programs, and emerging risks.
Security culture: Raise the security capabilities of the engineering organization through tooling, training, security champions, technical guidance, and mentorship.
Requirements
7+ years of experience in application, product, cloud, or infrastructure security, with strong hands-on security engineering experience.
Strong software engineering skills with the ability to read, write, and review production code and design practical security improvements.
Deep understanding of application and API security, authentication and authorization, cloud security, and modern software development and delivery.
Experience designing scalable security architecture and secure-by-default controls across applications and cloud infrastructure.
Understanding of AI and agentic security risks, including prompt injection, insecure tool use, excessive permissions, sensitive-data leakage, and risks associated with MCP and third-party AI integrations.
Proficiency in utilizing AWS security services (e.g. IAM, WAF, GuardDuty, AWS Inspector) and static and dynamic application security tools like CodeQL, Burp Suite, Zap, Nuclei.
Strong understanding of networking, security, and core Internet protocols (e.g. TCP/IP, DNS, SMTP, SSL, distributed networks).
Demonstrated ability to lead complex security initiatives across multiple teams, influence technical direction, and operate independently in ambiguous problem spaces.
Strong communication skills and the ability to translate security risks into practical engineering decisions.
Experience with AWS security services, application security tooling, SOC 2/ISO 27001, and AI-assisted security tools is a plus.
We know not everyone will check every box on day one. If this work excites you and you have strong experience in most of these areas, we'd love to hear from you.
Benefits
What You'll Get
A full-time position, with a competitive salary based on experience. The base salary for this role is $170k - $220k. In addition to base compensation, this role is eligible for a target annual bonus of 15% of base salary, and participation in long-term incentive programs tied to company growth and performance. We use market data and consider your job family, background, skills, experience, and U.S. work location to determine compensation within our established pay range.
Fully remote work environment with home office set-up allowance.
Real and lived work-life balance - Company perks include no pre-set vacation limits (with a top-down culture of taking meaningful PTO every year!), parental leave benefits, and a corporate value of working sustainably and putting families first.
Competitive benefits package that includes numerous health and wellness benefits.
401(k) plan, with employer contributions to the same.
Opportunity to work with amazing people who are passionate about their mission, thriving in a fully-remote work environment, and learning and growing every day.
At this time, Everyday Electric is unable to sponsor or take over sponsorship of employment visas. Candidates must be authorized to work in the United States without current or future immigration from the company, including training plans for foreign students.
