Security Engineer

Aspiron Search; New York (NY); On-site; USD 120,000 - 150,000; Full time

Job summary

Aspiron Search is partnering with an early-stage AI firm to hire its first dedicated Security Engineer in New York. You will own both infrastructure and application security from day one, defining security bar and shaping the team's trajectory.

The role requires hands-on coding in Python or Go, deep cloud experience (AWS or GCP), and a pragmatic approach to secure design, threat modelling, vulnerability management, and SOC 2 readiness.

Qualifications

• 4+ years in security engineering or infrastructure security.
• AppSec - secure code review, threat modelling, vulnerability classes.
• Strong engineering background and ability to write code (Python or Go).
• Hands-on securing production systems: authN/authZ, data protection, vulnerabilities.
• Strong cloud fundamentals (AWS and/or GCP).
• Pragmatism - building future-proof and secure code.

Responsibilities

• End-to-end application and infrastructure security ownership.
• Protect sensitive customer data and ensure auditability.
• Secure development practices including threat modelling and vulnerability mgmt.
• Detection and response - monitoring, alerts, and SOC 2 readiness.

Skills

Security engineering

Threat modelling

Secure code review

Python or Go

Cloud fundamentals

AuthN/AuthZ

Job description

Aspiron Search have partnered with an early-stage AI firm looking for their first dedicated Security Engineer!

You'd own both infrastructure and application security from the get-go, you won't be inheriting a stack or a backlog of products, instead you'll work to define what strong security looks like and set the technical bar the rest of engineering builds to.

Their platform handles highly sensitive customer data in a high-stakes commercial environment. To date it's been owned by a small engineering team alongside everything else, and the customer base has now outgrown that.

What you'll own

• Application and infrastructure security end to end -product, APIs and cloud estate
• Protecting sensitive customer data, from access model through to audit trail
• Secure development practices - threat modelling, security review in the SDLC, vulnerability management
• Detection and response - monitoring, alerting, and a process that works when called upon
• SOC 2 readiness

What they're looking for

• 4+ years in security engineering or infrastructure security
• AppSec - secure code review, threat modelling, understanding of vulnerability classes
• Strong engineering background, you'll clear the same bar as the product engineers and be writing code. (Python or Go preferred)
• Hands-on securing production systems: authN/authZ, data protection, common vulnerability classes
• Strong cloud fundamentals (AWS and/ or GCP)
• Pragmatism - building future-proof and secure code

Strongly preferred: you've built a security function at an early or growth-stage company rather than operated one inside a large enterprise. Staff-level breadth is welcome - this role will shape the team that follows.