Founding Security Engineer

Franklin Fitch; New York (NY); On-site; USD 150,000 - 210,000; Full time

Job summary

Franklin Fitch is hiring its first dedicated security engineer to build the function from the ground up in New York. You’ll own both application and cloud security, shaping the program end-to-end as the team expands.

You’ll partner with engineering to implement secure-by-default practices, automate tooling, and participate in security reviews with enterprise customers. This hands-on role offers influence over the roadmap and growth trajectory.

Qualifications

• Hands-on security engineering spanning application and cloud, with real depth in at least one area.
• Strong software engineering fundamentals; you write and review production code.
• Experience building security tooling and automation, not just vendor ops.
• Working knowledge of cloud environments, containerized workloads and IaC.
• Judgment to balance risk and avoid excessive compliance theatre.

Responsibilities

• Own application security across the product: threat modelling, secure design reviews, secure code review.
• Own cloud and infrastructure security: IAM, least privilege, network segmentation, secrets management.
• Develop security tooling in CI/CD: SAST, SCA, dependency and secrets scanning.
• Lead vulnerability management from discovery to remediation and verification.
• Define the security roadmap and prioritise work with the business and engineering.
• Partner with engineering on secure-by-default patterns and customer security reviews.

Skills

Security engineering

Software engineering

DevSecOps tooling

Cloud security

IAM & least privilege

Container security

Tools

SAST

SCA

Terraform

Kubernetes security tooling

Job description

Founding Security Engineer AI Scale-Up | New York

A venture-backed AI company in New York is hiring its first dedicated security engineer to build the function from the ground up, spanning application security and cloud security.

This is a hands-on role at a company with strong product-market fit, at the point where enterprise customers are starting to ask harder questions than the current setup was designed to answer. You'd own the programme end to end rather than inherit someone else's backlog.

What you'll own

• Application security across the product: threat modelling, secure design reviews, secure code review, and working with engineers to fix what you find
• Cloud and infrastructure security: IAM and least privilege, network segmentation, secrets management, container and Kubernetes security, and cloud posture across AWS or GCP
• Security tooling in CI/CD: SAST, SCA, dependency and secrets scanning, integrated so the secure path is the easy path rather than a gate engineers route around
• Vulnerability management end to end, from discovery and prioritisation through remediation and verification
• The security roadmap identifying where the real risk sits, sequencing the work, and making the case for what gets built and when
• Partnering with engineering on secure-by-default patterns, and with the business on customer security reviews and compliance groundwork
• Setting the direction for how the function grows, including where to hire next

What you'll need

• Hands-on security engineering experience spanning application and cloud security, with real depth in at least one
• Strong software engineering fundamentals — you write and review production code rather than only specifying fixes
• Experience building security tooling and automation, not just operating what vendors sell you
• Working knowledge of modern cloud environments, containerised workloads and infrastructure as code
• The judgment to tell a meaningful control from compliance theatre, and to accept managed risk when the alternative slows the business for no real gain
• Comfort operating without a playbook, and the credibility to influence engineers you have no authority over

Nice to have

• Prior experience as a first or early security hire
• AI and LLM security exposure: prompt injection, agent tool access, model supply chain
• Offensive security background that informs how you build
• SOC 2 or ISO 27001 experience from the engineering side rather than the audit side

The environment

Small, technically dense team with short feedback loops. Security is treated as something that helps the business ship, not something that slows it down.