Product Security Engineer

Tano AI Ltd; Greater London; On-site; GBP 135,000 - 165,000; Full time

Benefits offered by this job

Health insurance

Equity share options

Onsite gym

Job summary

Tano AI Ltd in London is hiring its first security engineer to own all security across the product, infrastructure and compliance. You will set strategy, write code, and report to the CTO.

You will threat-model the end-to-end system, guard agents that read creator messages, call tools and spend money, and build security checks directly into the shared codebase. The role includes securing data, implementing SOC 2 controls, incident response, and collaborating with brands and internal teams to

Qualifications

• Five or more years in security engineering, ideally as the first or only security hire at a startup or scale-up.
• Hands-on engineer: you write the fix, the CI check and the infrastructure code, not only the ticket.
• You can explain risks to a founder, a board or a brand's security team in plain English.

Responsibilities

• Threat-model the product end to end: the agents, the systems that pay creators and track their sales, and the apps brands and creators sign in to.
• Guard against prompt injection from creator messages and tool misuse, and set limits on tools, data, and budgets.
• Protect revenue systems from fraud, abuse, and costly mistakes; keep brand and creator data private.
• Build checks into code so security is automatic across repositories and pipelines.

Skills

Security engineering

Threat modeling

CI/CD security

Risk communication

Tools

TypeScript

NestJS

Next.js

Go

Postgres

Supabase

Fly.io

Vercel

Oneleet

Job description

Tano builds agents that run influencer marketing for brands like Hello Fresh, Bloom & Wild and Unilever. They read messages from thousands of creators, hold real tools and spend live brand budgets, around the clock. We are hiring our first security engineer to own all of it : part CISO, part the engineer who writes the fix.

One owner for security. You set the strategy, write the code and answer to the CTO.

What you would own

Everything security at Tano, with nobody between you and the work. You decide what matters, write it down and ship it, then explain it to the board and to the security teams at the brands we work with.

The hard part is the agents. They act on untrusted creator messages, call tools and move money, unattended for months. Keeping them inside clear limits on what they can do, with which data and how much they can spend, is a problem few security teams have had to solve yet.

Product security

• Threat-model the product end to end: the agents, the systems that pay creators and track their sales, and the apps brands and creators sign in to.
• Agents: guard against prompt injection from creator messages and tool misuse, and set the limits each one works within: the tools it can call, the data it can read, the budget it can spend, and the steps that need a person to approve.
• Money: protect the systems revenue depends on, from creator payouts and commission to discount codes and brand budgets, against fraud, abuse and costly mistakes.
• Data: keep each brand's data, and every creator's personal details, separate and private.
• Build the checks into the code everyone shares, so product engineers get them by default.

Infrastructure and secure development

• Least-privilege access across Supabase, Postgres, Fly.io and Vercel.
• Secret scanning, dependency scanning and static analysis in CI, with infrastructure defined as code.
• Logging, monitoring and an incident response plan that has been tested, not just written.

Compliance and trust

• Take Tano through SOC 2 Type I and into Type II, with evidence collected automatically through Oneleet.
• Own security reviews and questionnaires from brands, and the trust centre that answers most of them before they are asked.
• Run vendor reviews, access reviews, pentests and security training for the whole company.
• Ownership: a risk register and a security roadmap within your first month, and one clear line of escalation to the CTO.
• SOC 2: every control passing, the Type I report issued and the Type II observation window open.
• Time back for engineering: product engineers no longer collect evidence or fill in questionnaires.
• Posture: critical vulnerabilities triaged within a day and fixed within a week, a first pentest done and its findings fixed, and incident response tested.
• Secure by default: automated checks and secure infrastructure patterns in every repository, and clear limits on what each agent can do.

What we are looking for

• Five or more years in security engineering, ideally as the first or only security hire at a startup or scale-up.
• You have taken a company through SOC 2 or ISO 27001 and know which controls matter and which are paperwork.
• A hands‑on engineer: you write the fix, the CI check and the infrastructure code, not only the ticket.
• You can explain a risk to a founder, a board or a brand's security team in plain English, and make a call when the answer isn't clear.
• A real interest in how AI agents fail, and how to stop them failing badly.
• Bonus: cloud and infrastructure security · Postgres and Supabase depth · LLM or agent security work · TypeScript or Go.

The stack

TypeScript (NestJS, Next.js) and Go, with Postgres, LangGraph, Google Gemini, Supabase, Fly.io and Vercel. Oneleet for compliance. Early enough that you will set the security patterns everyone else builds on.

The team you would join

Will Caplan, CEO

GTM lead at Encord (YC AI scale-up), and Sandhurst.

Sagar, CTO

Three years building AI agents, early before it was a category.

Nathan, Founding Engineer

Fastest‑promoted engineer at a London YC scale-up.

Jake, Founding Engineer

Previously a founding engineer. Has grown a personal YouTube channel.

Previously did research at Stanford.

Process

• 02 Two 30‑minute calls with Sagar and Will: motivation and technical depth.
• 03 Onsite, mostly with Sagar: threat‑model one of our agents together, plus time with the team and lunch.

Roughly two weeks end to end.

What is on offer

Base Up to £150k, depending on experience

Equity Share options

Location Full-time, in person, central London

Benefits

• Health insurance, onsite gym, in‑person culture, real startup work‑life