Security Engineer

Town.com, Inc.; San Francisco (CA); On-site; USD 140,000 - 190,000; Full time

Job summary

Town.com, Inc. in San Francisco is seeking a dedicated Security Engineer to own security across the Town assistant and the agent surface, protecting data across email, calendar, docs, Slack, and CRM.

You’ll design and enforce threat modeling, secure SDLC, incident response, encryption, and access controls, while partnering with engineering to make the secure path the easy path. This is an in-office role in the SF Financial District.

Qualifications

• Extensive experience in security engineering across applications or infrastructure.
• Ability to read and write production code.
• Experience securing multi-tenant SaaS products handling sensitive data.
• Strong knowledge of cloud security, authn/authz, secrets, and encryption.

Responsibilities

• Own application and product security across Town's assistant and the agent surface.
• Threat-model autonomous agent behavior and guardrails.
• Secure the data pipeline and encryption/access controls.
• Harden cloud infrastructure and third-party OAuth integrations.
• Build and scale secure development lifecycle practices.
• Stand up and run incident response and postmortems.
• Collaborate with engineering to make secure paths the easy path.

Skills

Application security

Infrastructure security

Cloud security (AWS/GCP)

Threat modeling

Secure SDLC

Code security reviews

Tools

Cloud platforms (AWS/GCP)

Job description

About Town

We’re an applied AI company building a powerful assistant that makes it easy for anyone to create and use software in their everyday work. Town starts from who you are — it builds a persistent model of you (your voice, judgment, relationships, priorities) and does real work on your behalf across every tool you use: email, calendar, docs, Slack, CRM. It doesn’t wait to be prompted. It observes, learns, and acts.

We most recently raised a $55M Series A led by Andreessen Horowitz, with participation from Forerunner Ventures and continued support from First Round Capital, Alt Capital, and Conviction — plus angels including Adam D’Angelo, Soleio Cuervo, and Immad Akhund.

About the role

Town holds the keys to a person’s entire working life. To do real work on someone’s behalf, it reads their email, moves through their calendar, acts in their docs, Slack, and CRM. This means that security is absolutely paramount. We’re looking for a dedicated Security Engineer to own that surface end to end.

You’ll set the security bar for a company whose whole premise is trusted, autonomous access to sensitive data. That means securing the product and the agent that acts inside it, hardening the infrastructure and data pipeline behind it, and building the practices - threat modeling, secure SDLC, incident response. etc. that let us move fast without betraying that trust.

What you’ll do

• Own application and product security across the Town assistant and the agent action surface — the systems that read and act on user data across email, calendar, docs, Slack, and CRM.

• Threat-model autonomous agent behavior: prompt injection, tool misuse, the “lethal trifecta” of untrusted input + sensitive data + external action, and the guardrails that contain it.

• Secure the data pipeline behind Town’s persistent model of each user — encryption, tenant isolation, access controls, and secrets management.

• Harden our cloud infrastructure and third-party OAuth integrations (Google, Slack, CRM) against real-world attack.

• Build the secure development lifecycle: design reviews, code review for security, dependency and supply-chain hygiene, and the tooling to scale it.

• Stand up and run incident response — detection, triage, and clean postmortems.

• Partner across engineering to make the secure path the easy path.

You might thrive here if you…

• Have extensive experience in security engineering, with real depth in application and/or infrastructure security.

• Can read and write production code — you fix problems, not just file them.

• Have secured a multi-tenant SaaS product handling sensitive user data at scale.

• Know your way around cloud security (AWS and/or GCP), authn/authz, secrets, and encryption in practice.

• Threat-model instinctively and can explain risk to engineers and founders without hand-waving.

• Want to be the person who owns security from the ground up, and move at startup speed doing it.

• Get energy from working in person - we’re 5x per week at our office in downtown SF

Location

In-person in San Francisco’s Financial District, five days a week. Everyone is here to do their best work and make this product a success.