Security Lead

Trellis AI; San Francisco (CA); On-site; USD 180,000 - 260,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

Flexible PTO

Daily meals in the office

Team offsites

Job summary

Trellis AI is hiring its first Security Lead to own security end-to-end, from cloud to data, ensuring safe but rapid shipping of our healthcare AI agents. You’ll design controls, test them like an attacker, and interface with customers on security programs and audits.

You’ll report to the Co-founder & CTO and collaborate with engineers, executives, and healthcare partners to protect PHI, manage dependencies, and guide a growing security program in a fast-moving startup.

Qualifications

• 6+ years in security engineering, with time owning security at a startup or high-growth company.
• Deep experience with AWS security, IAM, and cloud infrastructure.
• Hands-on offensive security experience: penetration testing, red teaming, or bug bounty work.
• Experience running vulnerability management and incident response programs.
• Experience leading SOC 2 and/or HIPAA compliance efforts and answering customer security reviews.

Responsibilities

• Own security end to end: Set the roadmap across cloud, application, endpoint, and data security, and decide what matters most right now.
• Balance security with speed: Build guardrails and paved roads so engineers can ship quickly and safely, rather than adding gates that slow the team down.
• Run offensive security: Pen test our own agents, infrastructure, and Windows session fleet; run red-team exercises and fix what you find.
• Lock down the cloud and identity: Own AWS security posture, IAM, secrets management, least-privilege access, and trust boundaries between customers, agents, and internal systems.
• Manage vulnerabilities: Stand up scanning, triage, and patching across code, dependencies, containers, and hosts, with clear SLAs.
• Be the voice of security to customers: Answer security questionnaires, join diligence calls, and lead audits and certifications (SOC 2, HIPAA, HITRUST as needed).
• Plan for incidents: Build logging, detection, and an incident response plan, and run the response when something happens.

Skills

AWS security

Offensive security

Incident response

SOC 2 / HIPAA

Communication

Autonomy

Tools

Windows Server

Active Directory

Job description

TRELLIS BUILDS AND DEPLOYS SELF-IMPROVING AGENTS TO GET PATIENTS ACCESS TO LIFE-SAVING MEDICINE.

Our AI agents process billions of dollars worth of therapies annually with patients in all fifty states. We do this by automating document intake, prior authorizations, and appeals at scale to streamline operations and accelerate care. We classify medical referrals, understand chart notes, and automate contract and reimbursement search to provide patients with accurate coverage determinations and cost responsibility. Think of us as the infrastructure behind how patients get their medications.

Trellis is a spinout from Stanford AI Lab and is backed by leading investors including YC, General Catalyst, Telesoft Partners, and executives at Google and Salesforce.

THE ROLE

We're hiring our first Security Lead to own security at Trellis end to end. Our agents read and write to electronic health records, fill out insurance portals, and handle protected health information for some of the largest healthcare providers in the country. Customers trust us with that data, and you'll make sure that trust is earned without slowing down how fast we ship.

This is a hands-on role. You'll set the security strategy, build the controls yourself, test them like an attacker would, and be the person customers talk to when they want to know how we keep their data safe. You'll report to Jacky (Co-founder & CTO).

WHAT YOU'LL DO

• Own security end to end: Set the roadmap across cloud, application, endpoint, and data security, and decide what matters most right now

• Balance security with speed: Build guardrails and paved roads so engineers can ship quickly and safely, rather than adding gates that slow the team down

• Run offensive security: Pen test our own agents, infrastructure, and Windows session fleet; run red-team exercises and fix what you find

• Lock down the cloud and identity: Own AWS security posture, IAM, secrets management, least-privilege access, and trust boundaries between customers, agents, and internal systems

• Manage vulnerabilities: Stand up scanning, triage, and patching across code, dependencies, containers, and hosts, with clear SLAs

• Be the voice of security to customers: Answer security questionnaires, join diligence calls, and lead audits and certifications (SOC 2, HIPAA, HITRUST as needed)

• Plan for incidents: Build logging, detection, and an incident response plan, and run the response when something happens

ABOUT YOU

You've been the person responsible for security, not just a contributor to it. You're as comfortable reviewing an IAM policy or writing an exploit as you are walking a hospital CISO through our architecture. You care about real risk more than checklists, and you know that a security program engineers route around is not a security program.

WHAT YOU'LL BRING

• 6+ years in security engineering, with time owning security at a startup or high-growth company

• Deep experience with AWS security, IAM, and cloud infrastructure

• Hands-on offensive security experience: penetration testing, red teaming, or bug bounty work

• Experience running vulnerability management and incident response programs

• Experience leading SOC 2 and/or HIPAA compliance efforts and answering customer security reviews

• Comfort with Windows Server and Active Directory environments is a plus

• Healthcare or other regulated-industry experience is a big plus

• Clear communication with engineers, executives, and customers

• High ownership and the ability to operate autonomously in a fast-moving startup

WHY WORK WITH US

• Real impact at massive scale: We serve patients in all fifty states and are scaling to hundreds of healthcare locations. The systems you protect carry the health data of patients waiting on treatment.

• Incredible growth and traction: We've grown revenue 10x in the past few months alone.

• Work with the founding team: Partner directly with founders and F500 customers, alongside healthcare operations leaders who have overseen 50+ locations.

• Be at the forefront of AI in healthcare: Work on production-grade agentic systems that make critical healthcare decisions, not a demo.

• World-class team: Join teammates who have won international physics olympiads, published economics research, were founding engineers at unicorn startups, and taught AI classes to hundreds of Stanford graduate students.

Compensation & Benefits

The salary range above is our good-faith estimate. Your final level and base salary will reflect what you bring: your skills, your experience, and how much ownership you’re ready to take on. Base pay is only one part of the package. Every full-time teammate also gets meaningful equity, because the people building Trellis should share in what it becomes. We are committed to keeping you healthy and supported so you can do the best work of your career. Here are some of the benefits & perks we offer:

• Comprehensive medical, dental, and vision coverage

• Flexible PTO & Sick Time

• Daily meals in the office

• Team offsites

Equal Opportunity at Trellis

At Trellis, we're building AI agents that help patients get life-saving medicine faster. The patients and providers we serve come from every background, and our team should too. Trellis is an Equal Opportunity Employer. We hire based on talent, curiosity, and drive, without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other legally protected characteristic.

If you need an accommodation at any point in our hiring process, let your recruiter know and we'll take care of it.