Senior Security Engineer

Aleroy; Abu Dhabi; On-site; AED 300,000 - 600,000; Full time

Benefits offered by this job

24 days annual leave

Health insurance

Modern office in Yas Creative Hub

Job summary

Aleroy in Abu Dhabi is seeking its first dedicated security engineer to design, test and harden a multi-tenant cloud platform. You will review features, run tests, and drive security practices across engineering, with reporting to the COO and close collaboration with the CTO.

Our role focuses on threat modelling, cloud and production access controls, data handling and audits for ISO 27001 and SOC 2. You’ll need hands-on testing skills and a track record securing SaaS platforms.

Qualifications

• 6 to 10 years in security, with most of it in application security or cloud security.
• Hands-on testing skills: code review, API and web application testing, cloud configuration review.
• Deep experience with at least one major cloud provider, and with containers and Kubernetes or similar.
• You have secured a multi-tenant SaaS or platform product.
• You have implemented security controls that went through an ISO 27001 or SOC 2 audit, and you can show the evidence they produced.
• You have worked in a startup or scale-up, ideally as the first or an early security hire.
• You say clearly when something is not safe, explain the risk in business terms, and bring a practical fix.
• You work well with engineers: you review and challenge their work and still keep their trust.
• Clear written English. Your findings and reports can go straight to a customer or an auditor.

Responsibilities

• Threat modelling and design review of new features and architecture changes before they ship.
• Security testing of applications, APIs and cloud setups with remediation follow-up.
• Tenant isolation reviews to ensure data/workloads are kept apart with proof of compliance.
• Review of cloud and production access, secrets and configuration across systems.
• Technical due diligence on partners and suppliers whose infrastructure is used.
• Data handling audits for retention and deletion with evidence.
• Provide technical evidence for customer security reviews and ISO 27001 / SOC 2 audits.

Skills

Security testing

Threat modelling

Cloud security

Kubernetes

Code review

ISO 27001 / SOC 2

SaaS security

Multi-tenant SaaS

Tools

AWS

Azure

GCP

Job description

About Aleroy

Aleroy is building a unified platform for high-performance AI inference, making it easier for companies to deploy and run AI models at scale.
Through a single API, Aleroy provides access to ready-to-use and custom AI models across cloud infrastructure, dedicated capacity, and customers' own hardware. Our platform optimizes performance, cost, and deployment flexibility while giving enterprises control over where and how their AI workloads run.
We work in small teams, collaborate directly, and focus on solving complex engineering challenges to build reliable, scalable AI infrastructure.

About the Role

You are our first dedicated security engineer. Our engineering team builds and runs a multi-tenant cloud platform that also runs on infrastructure from partners. You review it, test it and challenge it, so that we, our customers and our auditors can trust it. The role is independent of the teams whose work you review, which is why it reports to the COO. You work closely with our CTO and engineers every day. We are preparing for ISO 27001 and SOC2, and you will help keep the technical side of that work honest after certification.

What You Will Own

• Threat modelling and design review. Security review of new features and architecture changes before they ship.

• Security testing. Regular testing of our applications, APIs and cloud setup, and follow-up until findings are fixed.

• Tenant isolation. Review of how customer data and workloads are kept apart, and proof that it holds.

• Cloud and production access. Review of access, secrets and configuration across our cloud and production systems.

• Partners and suppliers. Technical security due diligence on partners and suppliers whose infrastructure we use.

• Data handling. Checking that data retention and deletion work as designed, with evidence.

• Customer and audit assurance. Technical evidence for customer security reviews and for our ISO 27001 and SOC 2 audits.

Examples of Work in Your First Months

• A threat model of our core platform, agreed with engineering.

• A first round of security testing, with a clear plan for the findings.

• A simple, repeatable process for reviewing new partners before they go live.

About You

• 6 to 10 years in security, with most of it in application security or cloud security.

• Hands-on testing skills: code review, API and web application testing, cloud configuration review.

• Deep experience with at least one major cloud provider, and with containers and Kubernetes or similar.

• You have secured a multi-tenant SaaS or platform product.

• You have implemented security controls that went through an ISO 27001 or SOC 2 audit, and you can show the evidence they produced.

• You have worked in a startup or scale-up, ideally as the first or an early security hire.

• You say clearly when something is not safe, explain the risk in business terms, and bring a practical fix.

• You work well with engineers: you review and challenge their work and still keep their trust.

• Clear written English. Your findings and reports can go straight to a customer or an auditor.

Nice to Have

• Security of AI and LLM systems.

• Experience with key management, wallets or other crypto infrastructure.

• Scripting and automation, including using AI tools in security work.

• Experience working with customers in regulated or government sectors.

What We Offer

• The chance to build the security function of a growing group from the start.

• Direct work with the COO and CTO, and quick decisions.

• A competitive package, discussed during the process.

• 24 days annual leave plus public holidays.

• Health insurance.

• Modern office in Yas Creative Hub.