Security Engineer

Aspiron Search Limited; New York (NY); On-site; USD 120,000 - 180,000; Full time

Job summary

Aspiron Search Limited, in partnership with an early-stage AI firm, seeks its first dedicated Security Engineer to own both infrastructure and application security from day one. You’ll define what strong security looks like and set the technical bar for the engineering org.

The role involves securing product APIs and cloud estate, protecting sensitive data, and shaping secure development practices. This is a hands-on, architect-level security position in a fast-growing environment.

Qualifications

• 4+ years in security engineering or infrastructure security.
• AppSec: secure code review, threat modelling, vulnerability classes.
• Strong engineering background, able to write code (Python or Go).
• Hands-on securing production systems: authN/authZ, data protection, vulnerabilities.
• Strong cloud fundamentals (AWS and/or GCP).

Responsibilities

• Own application and infrastructure security end-to-end - product, APIs and cloud estate.
• Protect sensitive customer data from access to audit trails.
• Spearhead secure development practices: threat modelling, SDLC security reviews, vulnerability management.
• Establish detection and response: monitoring and alerting with effective playbooks.
• Lead SOC 2 readiness and security posture improvement.

Skills

Security engineering

Infrastructure security

AppSec

Threat modelling

Python or Go

Cloud fundamentals (AWS/GCP)

Hands-on production security

Job description

Aspiron Search have partnered with an early-stage AI firm looking for their first dedicated Security Engineer!

You'd own both infrastructure and application security from the get-go, you won't be inheriting a stack or a backlog of products, instead you'll work to define what strong security looks like and set the technical bar the rest of engineering builds to.

Their platform handles highly sensitive customer data in a high-stakes commercial environment. To date it's been owned by a small engineering team alongside everything else, and the customer base has now outgrown that.

For this role, I'm looking specifically for an engineer who has moved into security and remains hands on as an engineer. For those coming from an analyst to security position, this wouldn't be quite right unfortunately.

What you'll own

• Application and infrastructure security end to end -product, APIs and cloud estate
• Protecting sensitive customer data, from access model through to audit trail
• Secure development practices - threat modelling, security review in the SDLC, vulnerability management
• Detection and response - monitoring, alerting, and a process that works when called upon
• SOC 2 readiness

What they're looking for

• 4+ years in security engineering or infrastructure security
• AppSec - secure code review, threat modelling, understanding of vulnerability classes
• Strong engineering background, you'll clear the same bar as the product engineers and be writing code. (Python or Go preferred)
• Hands-on securing production systems: authN/authZ, data protection, common vulnerability classes
• Strong cloud fundamentals (AWS and/ or GCP)
• Pragmatism - building future-proof and secure code

Strongly preferred: you've built a security function at an early or growth-stage company rather than operated one inside a large enterprise. Staff-level breadth is welcome - this role will shape the team that follows.