Security Engineer, Security Tribe

HelloFresh; United States; Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

Meal kit discount

Company pension

Urban Sports Club

Headspace

Spill

Deutschlandticket

Home office budget

Job summary

HelloFresh is seeking a Principal Security Engineer to act as a top technical authority in security, shaping strategy and architecture across cloud, product security, and AI. You will partner with senior leadership to ensure security informs major decisions and scale secure capabilities across the company.

You will drive architecture, risk management, and secure-by-design principles while mentoring engineers and delivering practical, hands-on defense across AWS, Kubernetes, IAM, and data

Qualifications

• 15+ years of deep technical experience across multiple security domains.
• Proven track record shaping company-wide technical strategy and architecture.
• Hands-on security leadership across cloud, AI, and product security.

Responsibilities

• Demonstrate bias for action and drive security investments with measurable outcomes.
• Shape company strategy as a strategic technology advisor to leadership.
• Own secure design and architecture at scale across security domains.
• Identify systemic risks and drive secure-by-default cloud and product architectures.
• Define security for GenAI era including LLMs, AI agents, and model supply chains.
• Mentor senior staff and principal-track engineers while remaining hands-on when required.

Skills

Cloud Security

AppSec/Product Security

Offensive Security

Detection & Response

IAM/Zero Trust

Enterprise IT Security

Endpoint/MDM

GRC

Third-Party & Supply-Chain Security

GenAI Security

Tools

AWS Bedrock

Kubernetes

Claude

Gemini

Job description

Описание

We are looking for a Principal Security Engineer to serve as one of HelloFresh's most senior technical authorities in Security - shaping how we protect the company today while defining the security foundations we will need for the future. This is not a Principal role defined by ownership of a single security domain. Your domain is HelloFresh. You will operate at the intersection of technology strategy, security architecture, engineering and business risk, influencing some of the most consequential technical decisions we make. You will partner with senior Engineering, Product, Data, IT and business leadership to ensure security is not something applied after strategic decisions are made, but a fundamental input into those decisions. You think in systems, not Initiatives - and in years, not quarters. Where others see an IAM issue, application vulnerability, endpoint incident or AI risk, you look for the architectural condition connecting them. You ask not only "How do we fix this?" but "Why can this class of failure exist at HelloFresh, and what should we change so that it becomes difficult by design?" Your job is not merely to secure the systems HelloFresh has today. It is to influence what HelloFresh builds next, define the security architecture that makes it possible, and raise the technical capability of the organisation so that secure-by-default becomes a property of the company itself. You will bring exceptional breadth across Cloud Security, Application & Product Security, Vulnerability Management, Offensive Security, Detection & Response, Enterprise IT Security, IAM & Zero Trust, Endpoint/MDM, Governance & Risk, Third-Party & Supply-Chain Security, and GenAI Security - with the depth and judgment to challenge our strongest specialists and go hands on when the hardest problems demand it.

Задачи

• Demonstrate strong bias for action, moving quickly from ambiguity and constraints to clear decisions, ownership, and measurable outcomes. Balance speed with sound judgment, ensuring critical security risks are addressed decisively without creating unnecessary process or delay. Make Security AI-native. Identify operational work across Security that should no longer require repetitive human execution. Drive agents, automation, internal security products and self-service capabilities that encode security expertise and make it available at company scale - with appropriate permissions, human oversight, evaluation and auditability.
• Shape company and Group strategy through Security. Act as a strategic technical advisor to senior and executive leadership, influencing multi-year technology and business strategy across platforms, products, cloud, enterprise technology, AI, acquisitions and emerging technologies. Translate complex security issues into choices involving customer trust, resilience, engineering velocity, investment and business risk.
• Own and elevate secure design and architecture at scale across HelloFresh. Define our security architectural principles, reference architectures, trust boundaries, standards, patterns and guardrails with the security leads. Act as a senior technical advisor for our most consequential architecture and security-risk decisions. Connect the entire security system. Establish coherent technical direction across Cloud Security, AppSec/Product Security, Vulnerability Management, Offensive Security, Detection & Response, IT Security, IAM/Zero Trust, Endpoint & MDM, GRC and Third-Party/Supply-Chain Security.
• Identify systemic risks that individual teams cannot see or solve in isolation. Bring the industry perspective to implementation. Eliminate classes of risk, not individual findings. Drive secure‑by‑default cloud and product architecture across AWS, Kubernetes, IAM, networking, APIs, distributed systems, CI/CD and software supply chains. Evolve vulnerability management, offensive security and detection toward threat‑informed, exploitability‑driven and continuously validated defence.
• Define security for the AI and agentic era. Establish architecture for GenAI applications, LLMs, RAG, AI agents, MCP ecosystems and AI‑assisted engineering - covering identity, permissions, tool access, data boundaries, prompt injection, model supply chain, monitoring and auditability. Provide direction for AWS Bedrock, Claude, Gemini, open‑source GenAI models and open‑source security‑focused GenAI models and tooling.
• Be a force multiplier. Mentor Staff, Senior Staff and Principal‑track engineers, challenge architectural assumptions and raise the technical ceiling across Security and HelloFresh. Remain hands‑on enough to prototype, review code, analyse attack paths and validate difficult technical decisions when required.

Требования

• 15+ years of deep technical experience, with demonstrated impact at Senior Staff, Principal, Security Architect or comparable scope. The scale of your impact matters more than the number itself. Exceptional breadth across security with recognised depth in multiple domains and a track record of shaping company‑wide technical strategy and architecture.
• Deep expertise across several of Cloud Security, Product/AppSec, Offensive Security, Detection & Response, IAM/Zero Trust, Enterprise/IT Security, Endpoint/MDM, Security Platform Engineering and AI Security - with strong fluency across the broader landscape.
• Deep understanding of AWS/cloud‑native architecture, Kubernetes, IAM, networking, modern application architecture, APIs, distributed systems, CI/CD and software supply chains.
• Strong adversarial judgment and the ability to connect architecture, realistic attack paths, exploitability, detection and business consequence.
• Strong engineering skills in multiple programming languages such as Python, Go, Java, TypeScript or Rust.
• A history of building or shaping platforms, paved roads, automation, policy‑as‑code, security products and self‑service capabilities that materially changed how engineering organisations operate.
• Exceptional technical judgment and communication — equally credible discussing an exploit chain with a security researcher, architecture with a Staff Engineer and strategic risk with an executive.
• Demonstrated ability to influence without authority, make high‑consequence decisions under ambiguity and make other senior engineers more effective through your technical leadership.
• Experience operating at Principal, Distinguished Engineer or equivalent technical scope in a large technology organisation; hands‑on GenAI/LLM/agentic security experience; familiarity with OWASP guidance for GenAI/LLMs, MITRE ATLAS and NIST AI RMF; experience with AWS Bedrock, Claude, Gemini and open‑source GenAI/security models; experience with major technology transformations or acquisitions; and meaningful contributions through open source, security research, standards, publications or conferences.
• Relevant advanced certifications are welcome, but at this level original thinking, technical judgment, engineering credibility and demonstrated impact matter substantially more than certifications.

Условия

Global collaboration across HelloTech's hubs in Berlin, Warsaw, NYC, Boulder, and Toronto.

• Enjoy a discount on HelloFresh meal kits, delivered straight to your door.
• Build for the long‑term with our company pension scheme.
• Benefit from discounted memberships with Urban Sports Club and John Reed, yoga classes, and access to Headspace and Spill.
• Balance your work and life with flexible hours, Work From Home/Abroad options, and a home office setup budget.
• Receive childcare support (not available for interns/working students).
• Get a monthly allowance for the Deutschlandticket to support sustainable commuting.
• Embrace 'Learning Never Stops' with access to internal trainings and a central L&D budget (remove for interns).
• Work from a modern, comfortable office in Berlin-Kreuzberg and enjoy social events like team outings, Friday beers, and company runs.

Above all, we are looking for individuals who will make HelloFresh better. We believe there are many different ways of developing skills and we love diverse experiences, so even if you don't tick every box but think you'd thrive in this role, we'd really like to hear from you.