Security Engineer

Allium; Oregon; Hybrid; USD 120,000 - 170,000; Full time

Job summary

Allium is seeking a Security Engineer to design and operate controls securing our infrastructure, applications, employee systems, and AI usage. You will collaborate with engineering leadership to investigate threats, implement fixes, and automate security workflows.

The role combines hands-on coding with threat detection and remediation across humans and machines. You will help secure agent-driven workflows, enforce least privilege, and strengthen defenses against credential theft and

Responsibilities

• Secure cloud infrastructure and access.
• Implement least privilege, phishing-resistant authentication, short-lived credentials, controlled privileged access, and reliable provisioning and deprovisioning. Improve cloud configuration, managed credential storage, and network protections with service owners. Improve secrets scanning and prevent credentials from entering source control.
• Secure AI agents and developer tools. Help implement permissions, execution isolation, network restrictions, and audit trails for coding assistants, agents, and tool integrations, including MCP. Test how untrusted content could trigger prompt injection, tool misuse, or unintended data access, and build safeguards at the point where actions execute.
• Build detection and response. Correlate identity, cloud, workload, and CI/CD telemetry to detect credential theft, unusual access, unauthorized agent actions, suspicious software changes, and data exfiltration. Investigate attacks across systems, reduce alert noise, and test response procedures with system owners, including session revocation, exposed-credential rotation, and removal of unauthorized access.
• Reduce software supply-chain risk. Assess dependencies, CI/CD workflows, third-party integrations, and developer environments. Partner with engineers to

Job description

The 4 biggest blockchain strengths are also its weakness

Permissionless

nature leads to

fragmentation

of meaning

Decentralization

leads to

too many standards

Immutability

leads to exponential data + query infrastructure

complexity

Neutrality

means that no one is

accountable

for interpretations

Blockchain data is public. It is not usable at institutional scale. Despite being open, blockchain data is fragmented, hard to interpret, and painful to maintain. Even a simple question like “Who are the largest Ethereum token holders over time?” can require running nodes, ingesting full chain history, decoding contracts, cleaning edge cases, and writing complex SQL.Blockchains are optimized for writes, not reads.

They are built for consensus and execution, not searchability, standardization, or financial interpretation. Blockchains are computers, not databases. Every protocol defines its own schema. The same economic action can be encoded in dozens of different ways. The result:Fragmented standards

Exponential complexity

No accountability for interpretation

Events without economic meaning

Finance cannot operate on that, it needs an effective system of record. Allium is building the System of Record for Onchain Finance

Allium ingests, verifies, and standardizes data across 140+ blockchains and 30+ petabytes of history. We close four structural gaps that prevent blockchains from becoming systems of record:Semantic Gap: Translating raw events into financial concepts like payments, trades, deposits, and staking income Standardization Gap: Mapping thousands of protocols into a single canonical cross chain schema Infrastructure Gap: Read optimized, globally distributed data at web scale Accountability Gap: Auditable methodology, SLAs, and SOC 1 and 2 compliance The result is a neutral, canonical data layer institutions can build on with confidence.Finance is moving onchain Stablecoins, tokenized assets, trading, staking, and lending are growing rapidly. Institutions need a trusted source of truth for onchain financial activity, just as they rely on Bloomberg or DTCC in traditional markets. Raw blockchains cannot serve that role.As AI agents begin transacting autonomously, the requirement becomes even stricter. Agents cannot reason over raw event logs. They need structured data, attribution, condition checks, and auditability.Allium is the read layer that makes onchain finance usable for humans and machines.

Who We Serve

1. Finance, Accounting, and Risk Teams – They need reliable, audit grade answers. They rely on Allium for financial reporting, reconciliation, compliance, risk monitoring, and defensible metrics that can stand up to auditors and regulators.
2. Engineers and Product Teams – They need low latency, production ready infrastructure. They use Allium to power wallets, trading systems, payment rails, staking infrastructure, and real time applications that cannot break.
3. Strategy, Research, and Executive Teams – They need clarity and insight. They use Allium to understand ecosystem economics, market structure, user behavior, competitive dynamics, and where capital is flowing onchain.

And of course...agents . Our customers and users include Visa, Stripe, G-SIB Banks, Big 4 Accounting firms, BCG, Coinbase, Phantom, Uniswap and cited by the Federal Reserve.

About the role

We're hiring a Security Engineer to build and operate the controls that protect Allium's infrastructure, applications, employee systems, and use of AI. You'll work closely with Engineering and the person leading our security program to investigate threats, implement practical fixes, and automate security work.As AI agents gain access to code, data, and tools, security needs to cover both human and machine activity. You'll help secure how agents operate while strengthening our defenses against automated attacks, credential theft, and compromised software dependencies. This is a hands-on engineering role: you'll write code, test controls, investigate real signals, and take findings through remediation.

What you'll do

• Secure cloud infrastructure and access.
• Implement least privilege, phishing-resistant authentication, short-lived credentials, controlled privileged access, and reliable provisioning and deprovisioning. Improve cloud configuration, managed credential storage, and network protections with service owners. Improve secrets scanning and prevent credentials from entering source control.
• Secure AI agents and developer tools. Help implement permissions, execution isolation, network restrictions, and audit trails for coding assistants, agents, and tool integrations, including MCP. Test how untrusted content could trigger prompt injection, tool misuse, or unintended data access, and build safeguards at the point where actions execute.
• Build detection and response. Correlate identity, cloud, workload, and CI/CD telemetry to detect credential theft, unusual access, unauthorized agent actions, suspicious software changes, and data exfiltration. Investigate attacks across systems, reduce alert noise, and test response procedures with system owners, including session revocation, exposed-credential rotation, and removal of unauthorized access.
• Reduce software supply-chain risk. Assess dependencies, CI/CD workflows, third-party integrations, and developer environments. Partner with engineers to