Security Engineer

Avala; San Francisco (CA); Hybrid; USD 140,000 - 210,000; Full time

Benefits offered by this job

Health, dental, and vision coverage

FSA

Unlimited PTO

Job summary

Avala in San Francisco is hiring a security-focused engineer to own security across our platform, from compliance to infrastructure hardening. You will lead security programs for SOC 2 Type II and work with teams to embed security into development.

The role requires hands-on experience in application and infrastructure security, AWS knowledge, and vulnerability management. We offer competitive salary, equity, comprehensive benefits, and a mission to advance autonomous systems security.

Qualifications

• 4+ years in application, infrastructure, or security engineering.
• Experience with SOC 2, ISO 27001, or FedRAMP.
• Strong knowledge of AWS security services.
• Experience with vulnerability management and pen testing.
• Understanding of OWASP Top 10.

Responsibilities

• Lead SOC 2 Type II compliance and audit programs.
• Perform application security reviews and penetration testing.
• Design and implement infrastructure security controls across AWS (ECS, Aurora, S3).
• Build security monitoring, alerting, and incident response procedures.
• Evaluate and mitigate security risks in customer data handling workflows.
• Work with engineering teams to embed security into the development lifecycle.

Skills

SOC 2 compliance

Application security

Infrastructure security

Penetration testing

AWS security

Vulnerability management

OWASP Top 10

Tools

SAST tools

DAST tools

AWS security services

Job description

Posted 6 months ago San Francisco, CA full-time

About This Role

Own security for Avala's platform — from SOC 2 compliance to application security to infrastructure hardening. Our enterprise customers in autonomous vehicles and defense demand the highest security standards, and you'll ensure we exceed them.

What You'll Do:

• Lead SOC 2 Type II compliance and security audit programs
• Perform application security reviews and penetration testing
• Design and implement infrastructure security controls across AWS (ECS, Aurora, S3)
• Build security monitoring, alerting, and incident response procedures
• Evaluate and mitigate security risks in customer data handling workflows
• Work with engineering teams to embed security into the development lifecycle

Requirements:

• 4+ years in application security, infrastructure security, or security engineering
• Experience with SOC 2, ISO 27001, or FedRAMP compliance frameworks
• Strong knowledge of AWS security services and best practices
• Experience with SAST/DAST tools, vulnerability management, and pen testing
• Understanding of web application security (OWASP Top 10)

Nice to Have:

• CISSP, OSCP, or similar security certification
• Experience with defense/government security requirements (ITAR, CMMC)
• Background in securing ML or data pipeline infrastructure

AWS Infrastructure DevOps

What We Offer

Competitive salary and meaningful equity in the team building Fleet Learning Infrastructure for Physical AI

Full health, dental, and vision coverage, plus FSA and unlimited PTO

Work on the closed-loop data infrastructure that the next generation of autonomous systems learns from

A team that built Tesla Autopilot's data infrastructure, now building something bigger